CVE-2024-11667
Zyxel Multiple Firewalls Path Traversal Vulnerability
Zyxel Multiple Firewalls
A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series firmware versions V5.00 through V5.38, USG FLEX 50(W) series firmware versions V5.10 through V5.38, and USG20(W)-VPN series firmware versions V5.10 through V5.38 could allow an attacker to download or upload files via a crafted URL.
Exploitation status
CISA Known Exploited Vulnerabilities
Listed by CISA on 3 December 2024. US federal agencies were required to remediate it by 24 December 2024. CISA records this vulnerability as known to be used in ransomware campaigns.
EPSS — exploitation probability
FIRST puts the probability of exploitation activity in the next 30 days at 3%, which is higher than 87.3% of all scored vulnerabilities. EPSS is a forecast of activity, not a measure of severity, and it is rescored daily.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Frequently asked questions
Is CVE-2024-11667 being exploited by ransomware groups?
No ransomware group in this database is currently recorded as exploiting CVE-2024-11667.
What does CVE-2024-11667 affect?
CVE-2024-11667 affects Zyxel Multiple Firewalls. A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series firmware versions V5.00 through V5.38, USG FLEX 50(W) series firmware versions V5.10 through V5.38, and USG20(W)-VPN series firmware versions V5.10 through V5.38 could allow an attacker to download or upload files via a crafted URL.
How severe is CVE-2024-11667?
CVE-2024-11667 is rated HIGH with a CVSS base score of 7.5. EPSS puts the probability of exploitation in the next 30 days at 3%, higher than 87.3% of all scored vulnerabilities. It is listed in the CISA Known Exploited Vulnerabilities catalog, with a federal remediation deadline of 24 December 2024.
How should organisations respond to CVE-2024-11667?
Apply the vendor patch for Zyxel Multiple Firewalls as the first priority, and treat any internet-facing instance as the most urgent. Because this vulnerability is associated with ransomware activity, also review whether the affected systems were reachable before patching, rather than assuming that patching alone closes the incident.