Yes. CISA added CVE-2024-40891 to its Known Exploited Vulnerabilities catalogue on 11 February 2025, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the management commands that could allow an authenticated attacker to execute OS commands via Telnet.
What the Wild Exploitation Signal Means for This Zyxel Flaw
The key point is that this is not just a theoretical command-injection issue. Once a vulnerability reaches the CISA KEV catalogue, defenders should treat exposure as a current incident-response problem, not a routine patching task. For edge appliances, that means validating whether the device is internet-reachable, whether management access is exposed, and whether any authentication boundary can be reached from an untrusted network.
Because the weakness sits in management commands, the practical question is whether the affected device can be reached through the normal administrative path and whether those commands are still enabled. That makes Edge Device Security Guide directly relevant for checking exposure patterns, management-plane hardening, logging, and end-of-life handling on appliances of this class.
For practitioners, KEV status matters because it changes prioritisation. You are not deciding whether a vulnerability is interesting; you are deciding whether a known-exploited edge device needs immediate remediation, compensating controls, or containment before an attacker can reach the management interface again.
Why Post-Authentication Command Injection on DSL CPE Is Dangerous
Post-authentication command injection is especially serious on customer-premises equipment because the device often sits at the network boundary and is trusted by default for routing, remote administration, and sometimes support functions. If an authenticated attacker can turn management commands into operating-system commands, they may be able to change configuration, pivot into adjacent systems, or establish persistence on the appliance itself.
That pattern is consistent with broader internet-facing appliance abuse. The Web Application Attacks Guide is useful here because command injection is a classic unsafe input-handling flaw, and the same defensive logic applies whether the vulnerable surface is a web console, a Telnet-backed admin workflow, or another management channel.
The main operational concern is blast radius. A compromised CPE can become a foothold for traffic interception, configuration tampering, credential capture, or repeated reinfection if the management password, firmware state, or remote administration settings are not corrected at the same time as the vulnerability.
What to Do When Patching Has to Wait
If you cannot patch immediately, treat the appliance as exposed infrastructure and reduce the reachable attack surface first. That means restricting management access to trusted administrative sources, disabling remote management paths you do not need, and checking whether the device can be isolated from general internet reachability without breaking business connectivity.
Use the established exploited-vulnerability workflow rather than ad hoc triage. The Zero-Day and Exploited Vulnerabilities Guide aligns with the right sequence for this situation: confirm exposure, apply the vendor fix or mitigation as soon as possible, and perform compromise assessment if the device was reachable before you contained it.
At the same time, keep evidence. Preserve logs, configuration snapshots, and any record of management access so you can determine whether the flaw was used before containment. If the device served as a gateway for administrative access, rotate any credentials or secrets that may have been exposed through that administrative plane.
Risk and Threat Considerations
Internet-facing edge devices are attractive targets because they sit close to the perimeter, are often under-monitored, and can provide durable access when compromised. In practice, an exploited command-injection flaw on a DSL CPE can be used for persistence, configuration tampering, traffic redirection, or as a stepping stone to other internal assets.
Failure mechanism: An authenticated attacker reaches the management path, injects OS commands through the vulnerable command-processing logic, and uses appliance-level execution to alter settings or establish a persistent foothold.
Impact: The attacker may be able to modify network behavior, preserve access, or use the appliance as a launch point for follow-on compromise, especially if the device is left in service after the first exploitation.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP API Security Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5, CIS Controls v8, NIST CSF 2.0 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | Applies because known-exploited device flaws require tracked remediation and verification. |
| Recommendation — Prioritise remediation of the exploited Zyxel flaw and verify the fix on every exposed device. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | Applies because KEV-listed exploitation demands asset scope, prioritisation and remediation tracking. |
| Recommendation — Track exposed Zyxel devices, prioritise the KEV-listed flaw, and confirm remediation completion. | ||
| NIST CSF 2.0 | RC.RP-01 — Recovery Plan is Executed | Applies because exploited infrastructure needs a defined containment and recovery sequence. |
| Recommendation — Execute the recovery plan for affected devices and validate service restoration after containment. | ||
| OWASP ASVS | V15 — Secure Coding and Architecture | Applies because command injection is an input-handling and execution-boundary failure. |
| Recommendation — Review management-command handling to prevent unsanitised input reaching operating-system execution. | ||
| OWASP API Security Top 10 | API5 — Broken Function Level Authorization | Applies where management commands permit actions that should be restricted to trusted admins. |
| Recommendation — Enforce function-level authorization on administrative commands and block unauthorized management actions. | ||
Practitioner Guidance
What to verify: Confirm whether any Zyxel DSL CPE in scope is internet-reachable, still under active administrative use, and running a management configuration that exposes the vulnerable command path. If you cannot verify exposure quickly, assume the device is high priority until proven otherwise.
Decision rule: If the appliance handled external administration or sat on an untrusted network segment, prioritise containment and patching before wider forensic work. If patching must wait, reduce access first, then look for evidence of command execution, config changes, or unusual admin sessions.
Practitioner takeaway: KEV-listed edge-device flaws should be handled as live exposure, not historical vulnerability debt, because the management plane often gives attackers both reach and persistence if the box remains in service.