Active Exploitation of Zero-day Zyxel CPE Vulnerability (CVE-2024-40891) | Grey Noise Blog
Summary: GreyNoise is observing active exploitation attempts against a zero-day critical command injection vulnerability in Zyxel CPE Series devices tracked as CVE-2024-40891, which is unpatched and not publicly disclosed. The telnet-based flaw lets unauthenticated attackers execute arbitrary commands using the supervisor and/or zyuser service accounts, and Censys reports over 1,500 vulnerable devices online at publication.
Key Takeaway: VulnCheck disclosed this to partners on August 1, 2024, yet the vendor has published no CVE or advisory, and GreyNoise chose to publish immediately because of the large number of attacks - leaving more than 1,500 internet-facing devices exposed with no patch to apply.
Read the original at GreyNoise Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2024-40890CVE-2024-40891
- Related
- CVE-2024-40890: Zyxel DSL CPE OS Command Injection Vulnerability Known Exploited Vulnerabilities · Feb 11, 2025CVE-2024-40891: Zyxel DSL CPE OS Command Injection Vulnerability Known Exploited Vulnerabilities · Feb 11, 2025Noise Letter January 2025 Cyber Risks ·