Directory Traversal Vulnerability in Zyxel ATP and USG FLEX Products
CVE-2024-11667

9.8CRITICAL

Key Information:

Vendor
Zyxel
Status
Atp Series Firmware
Usg Flex Series Firmware
Usg Flex 50(w) Series Firmware
Usg20(w)-vpn Series Firmware
Vendor
CVE Published:
27 November 2024

Badges

💰 Ransomware👾 Exploit Exists🟣 EPSS 18%🦅 CISA Reported📰 News Worthy

Summary

CVE-2024-11667 is a directory traversal vulnerability identified in the web management interface of several Zyxel firmware versions. This flaw exists in Zyxel's ATP Series, USG FLEX Series, and USG20(W)-VPN Series firmware versions, which could potentially enable an unauthorized attacker to exploit crafted URLs to upload or download arbitrary files. Effective security measures and updated firmware are essential to protect against potential attacks leveraging this vulnerability. Organizations using these products should consult Zyxel's advisory for remediation steps.

CISA Reported

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed as being exploited and is known by the CISA as enabling ransomware campaigns.

The CISA's recommendation is: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Affected Version(s)

ATP series firmware versions V5.00 through V5.38

USG FLEX 50(W) series firmware versions V5.10 through V5.38

USG FLEX series firmware versions V5.00 through V5.38

News Articles

favicon imageThe Cyber Express

Zyxel Firewalls Exploited In Helldown Ransomware Attacks

Zyxel firewalls are targeted by Helldown ransomware via CVE-2024-11667. CERT-Bund warns of the risks and provides steps to secure devices.

2 months ago

References

https://www.zyxel.com/global/en/support/security-advisori...
vendor-advisory

EPSS Score

18% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 💰

    Used in Ransomware

  • 🦅

    CISA Reported

  • 👾

    Exploit known to exist

  • 📰

    First article discovered by The Cyber Express

  • Vulnerability published

  • Vulnerability Reserved

.