Zyxel · Multiple Firewalls
CVE-2024-11667
Zyxel Multiple Firewalls Path Traversal Vulnerability
What it is
A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series firmware versions V5.00 through V5.38, USG FLEX 50(W) series firmware versions V5.10 through V5.38, and USG20(W)-VPN series firmware versions V5.10 through V5.38 could allow an attacker to download or upload files via a crafted URL.
CISA: Multiple Zyxel firewalls contain a path traversal vulnerability in the web management interface that could allow an attacker to download or upload files via a crafted URL.
What to do
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Deadline for US federal agencies: December 24, 2024
More exploited flaws from Zyxel
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Jun 5, 2023 | Buffer Overflow | Multiple Firewalls | Critical 9.8 | 28% |
| Jun 5, 2023 | Buffer Overflow | Multiple Firewalls | Critical 9.8 | 29% |
| May 31, 2023 | OS Command Injection | Multiple Firewalls | Critical 9.8 | 99.3% |
| May 16, 2022 | OS Command Injection | Multiple Firewalls | Critical 9.8 | 99.9% |
| Sep 21, 2026 | Stack-Based Buffer Overflow | GS1900 Series Switches | High 8.8 | 2.8% |
| Feb 11, 2025 | DSL CPE OS Command Injection | DSL CPE Devices | High 8.8 | 21% |
| Feb 11, 2025 | DSL CPE OS Command Injection | DSL CPE Devices | High 8.8 | 23% |
| Sep 18, 2023 | Command Injection | EMG2926 Routers | High 8.8 | 33% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.