Wednesday , June 4 2025
Zyxel

CVE-2024-40891
Zyxel CPE Zero-Day Exploited in the Wild

Security researchers have alerted about ongoing exploitation attempts of a newly found zero-day command injection vulnerability in Zyxel CPE Series devices, known as CVE-2024-40891. The critical, unpatched vulnerability has left more than 1,500 devices worldwide at risk, according to Censys.

About the Vulnerability – CVE-2024-40891:

CVSS 9.6: IBM QRadar & Cloud Pak Security Flaws Exposed

IBM has issued a security advisory for vulnerabilities in its QRadar Suite Software and Cloud Pak for Security platforms. These...
Read More
CVSS 9.6: IBM QRadar & Cloud Pak Security Flaws Exposed

ALERT
Thousands of IP addresses compromised nationwide: CIRT warn

As Bangladesh prepares for the extended Eid-ul-Adha holidays, the BGD e-GOV Computer Incident Response Team (CIRT) has issued an urgent...
Read More
ALERT  Thousands of IP addresses compromised nationwide: CIRT warn

New Android Malware ‘Crocodilus’ Targets Banks in 8 Countries

In March 2025, the Threatfabric mobile Threat Intelligence team identified Crocodilus, a new Android banking Trojan designed for device takeover....
Read More
New Android Malware ‘Crocodilus’ Targets Banks in 8 Countries

Qualcomm Patches 3 Zero-Days Used in Targeted Android Attacks

Qualcomm has issued security patches for three zero-day vulnerabilities in the Adreno GPU driver, affecting many chipsets that are being...
Read More
Qualcomm Patches 3 Zero-Days Used in Targeted Android Attacks

Critical RCE Flaw Patched in Roundcube Webmail

Roundcube Webmail has fixed a critical security flaw that could enable remote code execution after authentication. Disclosed by security researcher...
Read More
Critical RCE Flaw Patched in Roundcube Webmail

Hacker claim Leak of Deloitte Source Code & GitHub Credentials

A hacker known as "303" claim to breach the company's systems and leaked sensitive internal data on a dark web...
Read More
Hacker claim Leak of Deloitte Source Code & GitHub Credentials

CISA Issued Guidance for SIEM and SOAR Implementation

CISA and ACSC issued new guidance this week on how to procure, implement, and maintain SIEM and SOAR platforms. SIEM...
Read More
CISA Issued Guidance for SIEM and SOAR Implementation

Linux flaws enable password hash theft via core dumps in Ubuntu, RHEL, Fedora

The Qualys Threat Research Unit (TRU) found two local information-disclosure vulnerabilities in Apport and systemd-coredump. Both issues are race-condition vulnerabilities....
Read More
Linux flaws enable password hash theft via core dumps in Ubuntu, RHEL, Fedora

Australia enacts mandatory ransomware payment reporting

New ransomware payment reporting rules take effect in Australia yesterday (May 30) for all organisations with an annual turnover of...
Read More
Australia enacts mandatory ransomware payment reporting

Why Govt Demands Foreign CCTV Firms to Submit Source Code?

Global makers of surveillance gear have clashed with Indian regulators in recent weeks over contentious new security rules that require...
Read More
Why Govt Demands Foreign CCTV Firms to Submit Source Code?

CVE-2024-40891 is a vulnerability that lets attackers run commands on systems without needing to log in, using accounts like “supervisor” or “zyuser.” This could allow attackers to take control of the system and steal data.

The vulnerability CVE-2024-40891 is similar to CVE-2024-40890, which was an HTTP-based issue, but it uses telnet as the attack vector.

GreyNoise security researchers have confirmed that this vulnerability is being actively exploited. Exploitation attempts appeared shortly after VulnCheck disclosed the vulnerability to select security partners on August 1, 2024.

Zyxel has not yet addressed the vulnerability with an official advisory or firmware update.

Exploitation Observed and Response:

GreyNoise and VulnCheck have been tracking malicious traffic associated with CVE-2024-40891 since January 21, 2025. Exploitation patterns and attacker IPs are now being tracked in real-time. Due to the high volume of attacks, security researchers chose to disclose this information publicly so organizations can act quickly to defend themselves.

This situation highlights the risks of zero-day vulnerabilities, especially in commonly used internet-facing devices like Zyxel’s CPE Series. Attackers can gain full control of affected devices through this flaw, posing a serious risk for organizations that rely on them.

Organizations using Zyxel CPE Series devices should take the following steps immediately:

Network Monitoring: Monitor network traffic for unusual telnet activity on Zyxel CPE management interfaces.
Access Controls: Limit admin access to trusted IP addresses and disable unused remote management features.
Vendor Updates: Keep an eye out for Zyxel security updates and apply them immediately.
EOL Devices: Decommission any devices that are no longer supported to reduce risks.

The cybersecurity community is urging Zyxel to release a patch quickly to address this vulnerability. In the meantime, organizations should take precautions to protect their networks.

Check Also

Qualcomm

Qualcomm Patches 3 Zero-Days Used in Targeted Android Attacks

Qualcomm has issued security patches for three zero-day vulnerabilities in the Adreno GPU driver, affecting …

Leave a Reply

Your email address will not be published. Required fields are marked *