Zyxel DSL CPE OS Command Injection Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 11/02/2025. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| DSL CPE Devices | Versions not published yet (product named by CISA KEV) | |
**UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the management commands of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device via Telnet.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free