CVE-2024-40891: command injection on Zyxel VMG4325-B10A gateway

CVE-2024-40891 is a post-authentication command injection vulnerability affecting the Zyxel VMG4325-B10A, a legacy residential DSL CPE gateway widely deployed in residential and small business infrastructure. An authenticated attacker can execute arbitrary OS commands via Telnet on the management interface, potentially compromising device integrity and local network security.

The vulnerability is rated CVSS 8.8 (high severity). The NVD entry marks it as 'unsupported when assigned', confirming the product is legacy and no longer receives official support. GitHub signals from 2026-10-30 indicate ongoing public interest and possible availability of technical analysis materials.

For defenders: immediately audit your network for VMG4325-B10A instances; check Telnet access logs and authentication events; verify credential management and disable default credentials; disable Telnet or restrict to protected networks if firmware supports SSH; consider device replacement in environments where insider access or network compromise poses business risk.