Attackers actively exploit a critical zero

Multiple Zyxel DSL CPE devices contain an OS command injection flaw (CWE-78) in a CGI program, where insufficient input handling lets a crafted HTTP request execute arbitrary operating-system commands. Because the flaw is post-authentication, an attacker needs valid credentials on the device's web management interface to trigger it, but can then run commands with the privileges of the device's web server, enabling configuration changes, persistence, or pivoting to the ISP subscriber network. Only Zyxel DSL CPE devices are affected; the specific models and firmware versions have not been detailed in the available data, and CISA notes impacted products may be end-of-life or end-of-service. The vulnerability was added to the CISA Known Exploited Vulnerabilities catalog on 2025-02-11, confirming exploitation in the wild, though no public proof-of-concept is known and ransomware use has not been observed. EPSS assigns a 22.3% probability of exploitation within 30 days (98th percentile), indicating elevated exploitation risk.

Do: Inventory all Zyxel DSL CPE devices and check them against Zyxel's advisory to identify affected models, then apply the latest available firmware; since many affected products may be end-of-life or end-of-service, plan replacement or discontinuation of use where no patched firmware or mitigation exists (as CISA's KEV required action directs). In the interim, restrict the device's HTTP/HTTPS management interface to trusted networks, disable remote/WAN-side administration, and ensure strong, non-default admin credentials since exploitation requires authentication.