CVE-2024-11667

Description

A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series firmware versions V5.00 through V5.38, USG FLEX 50(W) series firmware versions V5.10 through V5.38, and USG20(W)-VPN series firmware versions V5.10 through V5.38 could allow an attacker to download or upload files via a crafted URL.

Scoring

• CVSS: 7.5 (HIGH, 3.1)
• EPSS exploitation probability: Not yet available
• EPSS percentile: Not yet available

CISA KEV status

• Added to KEV: 2024-12-03
• Remediation due date: 2024-12-24
• Known ransomware campaign use: Known

Weakness types (CWE)

• CWE-22

References

• https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-protecting-against-recent-firewall-threats-11-27-2024
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-11667

More from Zyxel

• CVE-2026-7273 — GS1900 Series Switches
• CVE-2024-40891 — DSL CPE Devices
• CVE-2024-40890 — DSL CPE Devices
• CVE-2017-6884 — EMG2926 Routers
• CVE-2017-18368 — P660HN-T1A Routers