Dive Brief:
- An actively exploited vulnerability disclosed last week in Zyxel CPE Series devices involves routers that have reached end-of-life status, VulnCheck researchers said in a blog post released Tuesday.
- Researchers from GreyNoise warned late last month that the vulnerability, tracked as CVE-2024-40891, was under active exploitation and had yet to be patched or formally disclosed by the manufacturer. Researchers later confirmed the ability to exploit CVE-2024-40891 had been incorporated into certain strains of the Mirai botnet.
- Zyxel confirmed that vulnerabilities tracked as CVE-2024-40890, CVE-2024-40891 and CVE-2025-0890 impact certain DSL CPE models that have been out of service for years. The company urged users to replace the legacy products with modern, supported versions, according to a bulletin released Tuesday.
Dive Insight:
Researchers from VulnCheck originally disclosed CVE-2024-40891, which is a critical command injection vulnerability, in August 2024. VulnCheck and GreyNoise researchers worked together to confirm the vulnerability; however, GreyNoise revealed the flaw in late January as the manufacturer had not yet made a public disclosure or released a patch.
The CVE can allow an attacker to execute arbitrary commands. Attackers can engage in various post exploitation activities, including data exfiltration or system compromise.
VulnCheck researchers had communicated their concerns with Zyxel and were initially expecting some sort of coordinated disclosure. However, Zyxel officials have not made any public disclosure nor have they returned repeated requests for comment.
“Most of our conversations [with Zyxel] have focused on coordination of public details,” Jacob Baines, CTO of VulnCheck, told Cybersecurity Dive via email.
Baines said it was unlikely the vendor would be issuing a patch, due to the end-of-life status of the devices.
Most of the routers are residential, but threat groups have exploited various edge devices in recent years to target critical infrastructure using living-off-the-land techniques.
VulnCheck researchers said in the blog post that an authenticated command injection has limited value on its own, but said the devices in question “appear to be provisioned with default accounts.”
Therefore an identifier has been assigned for the default credentials issue as CVE-2025-0890, which involves the use of insecure default credentials for the Telnet function in legacy DSL CPE VMG4325-B10A firmware.
