Noise Letter January 2025
Summary: GreyNoise confirmed on 2025-01-29 that some Mirai variants now exploit CVE-2024-40891, a critical zero-day command injection flaw in Zyxel CPE devices that allows attackers to execute arbitrary commands and fully compromise the system. The vulnerability is currently unpatched and undisclosed, more than 1,500 vulnerable devices are online, and GreyNoise worked with VulnCheck to verify detection accuracy and published a tag to track exploitation.
Why it matters: More than 1,500 Zyxel CPE devices are exposed to a flaw with no patch and no disclosure, and Mirai variants are already exploiting it - so the window to act closes before a fix even exists.
Read the original at GreyNoise Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2024-40891
- Related
- CVE-2024-40891: Zyxel DSL CPE OS Command Injection Vulnerability Known Exploited Vulnerabilities · Feb 11, 2025Active Exploitation of Zero-day Zyxel CPE Vulnerability (CVE-2024-40891) | Grey Noise Blog Cyber Risks ·Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026