A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX ser…

published 2024-11-27 23 mo ago modified 2026-08-05 3 mo ago also EUVD-2024-34151

cvss: 7.5; version 3.1, CNA
cisa kev: Exploited; added 2024-12-03, used in ransomware
epss: 3.0%; EPSS 3.0% chance of exploitation in 30 days, percentile 87%
public exploits: 0; none known

A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series firmware versions V5.00 through V5.38, USG FLEX 50(W) series firmware versions V5.10 through V5.38, and USG20(W)-VPN series firmware versions V5.10 through V5.38 could allow an attacker to download or upload files via a crafted URL.

Patch / fix

cisa required action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

fixed in 1

zyxel usg_flex_50w_firmware 5.38

Timeline

2024-11-27 Published
2024-12-03 Added to CISA KEV
2024-12-05 CISA SSVC: exploitation active
2024-12-24 CISA patch deadline

Known exploited

Added: 23 mo ago (2024-12-03)
Patch by: 2024-12-24 (22 mo ago)
Ransomware: Known to be used in ransomware campaigns
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Vendor, product: Zyxel, Multiple Firewalls
CISA name: Zyxel Multiple Firewalls Path Traversal Vulnerability

Ransomware

Groups reported to have exploited it in intrusions.

Helldown ransomware gang

reported by blog.sekoia.io

Ransomware Vulnerability Matrix by BushidoUK (github.com/BushidoUK/Ransomware-Vulnerability-Matrix), reformatted per CVE. CC BY 4.0

CISA SSVC

Exploitation: Active, exploited in the wild
Automatable: yes
Technical impact: partial
Assessed: 23 mo ago (2024-12-05)

Exploit prediction

2.95% chance of exploitation in the next 30 days, higher than 87% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Zyxel ATP series firmware
Zyxel USG FLEX series firmware
Zyxel USG FLEX 50(W) series firmware
Zyxel USG20(W)-VPN series firmware
zyxel usg_flex_firmware
zyxel atp_firmware
zyxel usg20-vpn_firmware
zyxel usg_flex_50w_firmware

Classification

Weakness

CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

zyxel.com /global/en/support/security-advisories/zyxel-security-advisory-protecting-against-recent-firewall-threats-11-2
vendor-advisory
cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-11667
government-resource, us-government-resource

Sources

CVE List CVE-2024-11667
NVD CVE-2024-11667

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary