Loading story…
Researchers and defenders warned that two critical zero-day vulnerabilities in Zyxel CPE devices, CVE-2024-40890 and CVE-2024-40891, are being actively exploited in the wild. The flaws affect Zyxel CPE models that are now end-of-life and can enable command injection leading to full device compromise; reporting from GreyNoise highlighted active exploitation of CVE-2024-40891, while CSIRT.SK said Mirai-based botnet variants have been observed abusing the issue.
The exposed devices appear to be attractive initial-access targets because they sit at the network edge and can be conscripted into botnets or used as footholds into victim environments. Zyxel is not expected to issue patches for the affected hardware, leaving organizations to mitigate by replacing vulnerable devices, restricting access to administrative interfaces, and increasing monitoring of HTTP and Telnet traffic for signs of exploitation and post-compromise activity.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
In its advisory, CSIRT.SK stated that the affected Zyxel CPE models were end-of-life and that Zyxel was not expected to release patches. It recommended replacing vulnerable devices, restricting administrative interface access, and monitoring HTTP and Telnet traffic.
CSIRT.SK warned that both CVE-2024-40890 and CVE-2024-40891 in Zyxel CPE devices were under active exploitation. It said the flaws could enable command injection and full compromise, and noted reports linking CVE-2024-40891 exploitation to Mirai-based botnet variants.
GreyNoise reported that the Zyxel CPE vulnerability CVE-2024-40891 was being actively exploited as a zero-day. The report tied exploitation to internet-exposed Zyxel devices.
VulnCheck's July 2024 Initial Access Intelligence update included CVE-2024-40891 among notable vulnerabilities, establishing early public tracking of the Zyxel CPE issue.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
csirt.sk
Open sourcegreynoise.io
Open sourcevulncheck.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Zyxel warned that **CVE-2020-9054** is a critical pre-authentication remote code execution flaw in the `weblogin.cgi` component of certain NAS and firewall products, caused by missing authentication that enables OS command injection. The company said affected systems include NAS devices running firmware **5.21 and earlier** and several UTM, ATP, and VPN firewall releases on **ZLD V4.35 Patch 0 through Patch 2**, and urged customers to install firmware updates immediately or apply workarounds for unsupported devices. Zyxel later reiterated the risk after noting that BotenaGo malware was targeting devices with known CVEs, advising organizations to patch or isolate internet-exposed systems. Palo Alto Networks' Unit 42 reported that a public proof of concept for **CVE-2020-9054** was quickly weaponized to compromise vulnerable Zyxel NAS devices and install a Mirai variant dubbed **Mukashi**. Researchers observed exploitation in the wild beginning March 12, 2020, with attackers using a shell script to fetch architecture-specific bot binaries, erase traces, and enroll devices into a botnet that scans TCP port **23**, brute-forces default credentials, and supports multiple DDoS commands. Unit 42 said the malware communicated with **45[.]84[.]196[.]75** over TCP ports **34834** and **4864**, while also binding locally to TCP port **23448** to prevent multiple infections on the same host.
Aug 15, 2026
A Mirai variant rapidly spread by targeting **ZyXEL PK5001Z** routers affected by `CVE-2016-10401`, a backdoor account flaw that exposed hardcoded Telnet credentials and a hidden path to root access. After proof-of-concept exploit code was published, attackers began scanning ports `23` and `2323` at scale, logging in with credentials including `admin/CenturyL1nk` and `admin/QwestM0dem`, then using the device's built-in super-user capability to install Mirai malware on vulnerable internet-exposed routers. Researchers reported nearly **100,000 unique scanning IPs** over roughly 60 hours, with a large share of activity traced to Argentina, particularly networks associated with Telefonica de Argentina. Netlab linked the campaign to command-and-control servers at `bigboatreps.pw:23` and `blacklister.nl:23`, and said the malware was distributed in multiple CPU-specific builds before both servers were later sinkholed by the security community. The vulnerable modem version cited in public exploit material was **PK5001Z 2.6.20.19**, a model used by CenturyLink.
Aug 15, 2026
A Mirai-based malware campaign is actively exploiting **CVE-2025-29635**, a high-severity command-injection flaw in end-of-life **D-Link DIR-823X** routers, marking the first reported in-the-wild abuse of the vulnerability since its public disclosure and proof-of-concept release in 2025. Akamai said it began seeing attacks in early March 2026 through crafted `POST` requests to the `/goform/set_prohibiting` endpoint, where unsanitized input reaches `system()` and enables remote command execution on affected firmware versions **240126** and **240802**. The activity targets discontinued devices unlikely to receive vendor fixes, increasing exposure for organizations still running the routers. The attackers use the exploit to fetch and run a shell script that installs a Mirai variant dubbed **tuxnokill**, which retains common Mirai strings while using XOR obfuscation with key `0x30`. Akamai linked the same actor to similar Mirai deployment patterns against **TP-Link AX21** devices via **CVE-2023-1389** and against **ZTE ZXV10 H108L** routers through another remote code execution flaw, underscoring continued botnet weaponization of older, publicly documented vulnerabilities. Security advisories recommend replacing unsupported D-Link hardware, restricting exposed administrative interfaces, and rapidly remediating known router flaws before they are folded into botnet operations.
Jun 29, 2026