DaystoPatch

ZyxelExploited incident

Zyxel legacy DSL CPE command injection flaws exploited by Mirai; end-of-life, no fix

CVE-2024-40890, CVE-2024-40891, CVE-2025-0890High, CVSS 8.8In CISA's Known Exploited Vulnerabilities catalog since 11 Feb 2025

  • Exploited before a fix
  • End of life: vendor advises replacement
End of lifeEnd-of-life product. Zyxel advises replacing it and plans no fix, so it is not on the live board.
Embed this live clock

Response

Silence
7d
First public report to first vendor statementUnverified source
Exposure
no fix planned
First public report to first fix
Follow-through
no fix planned
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    date onlyUnverified: no archived copy, quote not checked yet

    GreyNoise blog (Glenn Thorpe)CuratedQuote not checked yet

    GreyNoise is observing active exploitation attempts targeting a zero-day critical command injection vulnerability in Zyxel CPE Series devices tracked as CVE-2024-40891.

    Post dated January 28, 2025 (updated 2025-01-29 with Mirai findings). VulnCheck had reported the bugs to Zyxel in mid-2024 (secondary sources).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    Yes
    Dispute this timestamp
    5 more sources for this moment
    Bluesky postClaimedQuote not checked yet28 Jan 2025, 21:13 UTC

    🚨 Zero-day Zyxel Vulnerability (CVE-2024-40891) under active exploitation. This unpatched flaw exposes 1,500+ devices, enabling system compromise. Monitor traffic, restrict admin access, and track live attacks

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet29 Jan 2025, 14:44 UTC

    Active Exploitation of Zero-day Zyxel CPE Vulnerability (CVE-2024-40891) # CVE_2024_40891 https://www. greynoise.io/blog/active-explo itation-of-zero-day-zyxel-cpe-vulnerability-cve-2024-40891

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2024-40890ClaimedQuote verified4 Feb 2025, 09:55 UTC

    **UNSUPPORTED WHEN ASSIGNED**

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:e4bd3fd5f5c4da94…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2024-40890)ClaimedQuote verified11 Feb 2025

    Zyxel DSL CPE OS Command Injection Vulnerability

    Added to CISA's KEV catalog on 2025-02-11.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2024-40891)ClaimedQuote verified11 Feb 2025

    Zyxel DSL CPE OS Command Injection Vulnerability

    Added to CISA's KEV catalog on 2025-02-11.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    +7d

    CVE record CVE-2024-40890 (CNA: Zyxel)CuratedQuote verified

    "datePublished":"2025-02-04T09:55:38.908Z"

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:e4bd3fd5f5c4da94…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    Zyxel security advisory (legacy DSL CPE, 02-04-2025)CuratedQuote verified4 Feb 2025

    Zyxel recently became aware of CVE-2024-40890 and CVE-2024-40891 being mentioned in a post on GreyNoise’s blog.

    Revision history: '2025-2-4: Initial release'. Zyxel is in Taiwan (UTC+8); the CVE record time 09:55Z is 17:55 Taiwan time on the same date.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:52d87e9e2220de28…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  3. First workaround

    date only+7d

    Zyxel security advisory (legacy DSL CPE, 02-04-2025)CuratedQuote verified

    Additionally, disabling remote access and periodically changing passwords are proactive measures that can help prevent potential attacks.

    The vendor's primary advice is to replace the end-of-life devices.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:52d87e9e2220de28…
    Used in metrics
    Yes
    Dispute this timestamp

  4. First fix

    No fixed release found yet for any affected branch.

  5. Fixed for all versions

    No evidence yet of fixed releases for every supported branch.

Send this to your boss

Old Zyxel DSL routers exploited by botnets; Zyxel will not patch

Attackers, including Mirai botnets, exploit command injection flaws in end-of-life Zyxel DSL routers, and Zyxel's only remedy is to replace them.

In plain words

Some old Zyxel internet routers have security holes that criminals are using to take them over and add them to botnets. Zyxel will not fix them because the models are long out of support. If any of our offices still use one, it needs to be replaced; in the meantime remote management should be switched off and passwords changed.

What happened and who is affected

What happened

On 28 January 2025 GreyNoise reported active exploitation of CVE-2024-40891, an unpatched command injection flaw in Zyxel DSL customer-premises equipment, and later found it built into Mirai botnet variants. On 4 February 2025 Zyxel confirmed CVE-2024-40890, CVE-2024-40891 and an insecure default Telnet credential issue (CVE-2025-0890) affect legacy models that reached end of life years ago. Zyxel issued no fix and recommends replacing the devices.

Who is affected

Zyxel VMG1312-B10A, VMG1312-B10B, VMG1312-B10E, VMG3312-B10A, VMG3313-B10A, VMG3926-B10B, VMG4325-B10A, VMG4380-B10A, VMG8324-B10A, VMG8924-B10A, SBG3300 and SBG3500, often supplied by internet service providers.

CVE-2024-40890, CVE-2024-40891, CVE-2025-0890. Reviewed 22 Oct 2026. https://daystopatch.com/incidents/zyxel-cve-2024-40890/

Affected products

  • Zyxel legacy DSL CPE: VMG1312-B10A/B10B/B10E, VMG3312-B10A, VMG3313-B10A, VMG3926-B10B, VMG4325-B10A, VMG4380-B10A, VMG8324-B10A, VMG8924-B10A, SBG3300, SBG3500
How we built this timeline

Unpatched by design: Zyxel marks all three CVEs 'UNSUPPORTED WHEN ASSIGNED' and will not release fixes. Exploitation was public before the vendor acknowledged it (GreyNoise published without vendor coordination because of the attacks).

KEV added CVE-2024-40890 and CVE-2024-40891 on 11 Feb 2025; CVE-2025-0890 is not in KEV.

Attacks require valid credentials (often defaults), per Zyxel. CVSS 8.8 (Zyxel CNA, both KEV CVEs). end_of_life: Zyxel says the models 'are legacy products that have reached end-of-life (EOL) for years.

Therefore, we strongly recommend that users replace them with newer-generation products for optimal protection.' KEV requiredAction: 'The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.' Automated check: exposure over 365 days; needs human review.

Related

No related incidents.

Zyxel report card