Coverage › CVE-2024-40891

CVE-2024-40891 Mapped Partial Sigma

Zyxel DSL CPE OS Command Injection Vulnerability

Vendor / product

Zyxel — DSL CPE Devices

Description (CISA)

Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the management commands that could allow an authenticated attacker to execute OS commands via Telnet.

Added to KEV

2025-02-11

Due date

2025-03-04

Required action

The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.

Known ransomware use

Unknown

CWE

CWE-78

CISA notes

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-insecure-default-credentials-vulnerabilities-in-certain-legacy-dsl-cpe-02-04-2025
https://www.zyxel.com/service-provider/global/en/security-advisories/zyxel-security-advisory-command-injection-insecure-in-certain-legacy-dsl-cpe-02-04-2025
https://nvd.nist.gov/vuln/detail/CVE-2024-40891

Elsewhere

cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

2 mapping objects across 2 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1011 Exfiltration Over Other Network Medium primary impact

• DET0077 Detection of Exfiltration Over Alternate Network Interfaces
  AN0212 Windows

  Execution of file transfer or network access activity through non-primary interfaces (e.g., WiFi, Bluetooth, cellular) by processes not typically associated with such behavior (e.g., rundll32, powershell, regsvr32).

  WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

  WinEventLog:System EventCode=5005 (WLAN), EventCode=302 (Bluetooth) → DC0085 Network Traffic Content

  WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

  Tunable: InterfaceType FileSizeThreshold TimeWindow
  AN0213 Linux

  Use of rfkill, nmcli, or low-level tools (e.g., iw, hcitool, pppd) to enable alternate interfaces followed by data transfer via non-primary NICs.

  auditd:SYSCALL None → DC0064 Command Execution

  NSM:Flow None → DC0078 Network Traffic Flow

  Tunable: CommandPattern NetworkDevice
  AN0214 macOS

  AppleScript or system calls to activate WiFi/Bluetooth interfaces (networksetup, blueutil), followed by exfiltration via AirDrop, cloud sync, or network socket.

  macos:unifiedlog None → DC0085 Network Traffic Content

  macos:osquery process_events → DC0032 Process Creation

  macos:osquery interface_details → DC0018 Host Status

  Tunable: Protocol InterfaceActivityWindow

Sigma rules tagged attack.t1011 (0)

None. MITRE's strategy above is the only public detection guidance for this technique.

T1055 Process Injection exploitation technique

• DET0508 Behavioral Detection of Process Injection Across Platforms
  AN1399 Windows

  Detects process injection by correlating memory manipulation API calls (e.g., VirtualAllocEx, WriteProcessMemory), suspicious thread creation (e.g., CreateRemoteThread), and unusual DLL loads within another process's context.

  WinEventLog:Sysmon EventCode=10 → DC0035 Process Access

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=7 → DC0016 Module Load

  etw:Microsoft-Windows-Kernel-Process API calls → DC0021 OS API Execution

  Tunable: AccessMask TimeWindow InjectedProcessList
  AN1400 Linux

  Detects ptrace- or memfd-based process injection through audit logs capturing system calls (e.g., ptrace, mmap) targeting running processes along with suspicious file descriptors or memory writes.

  auditd:SYSCALL ptrace, mmap, process_vm_writev → DC0021 OS API Execution

  auditd:SYSCALL open → DC0055 File Access

  linux:procfs /proc/[pid]/maps, /proc/[pid]/mem → DC0020 Process Modification

  Tunable: TargetPIDThreshold TimeWindow
  AN1401 macOS

  Detects memory-based injection by monitoring task_for_pid, mach_vm_write, and dylib injection patterns through DYLD_INSERT_LIBRARIES or manual memory mapping.

  macos:unifiedlog subsystem=com.apple.security, library=libsystem_kernel.dylib → DC0035 Process Access

  macos:endpointsecurity ES_EVENT_TYPE_NOTIFY_EXEC, ES_EVENT_TYPE_NOTIFY_MMAP → DC0034 Process Metadata

  macos:syslog DYLD_INSERT_LIBRARIES anomalies → DC0016 Module Load

  Tunable: TargetProcessSignature MachSyscallContext

Sigma rules tagged attack.t1055 (37)

All 37 rules on the technique page →