Live › vulnerability › CVE-2024-11667
Go to dashboardMultiple Zyxel firewalls have a path traversal flaw in the web management interface that lets a crafted URL download or upload arbitrary files. CISA lists it as known exploited, and the sources note ransomware use.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Zyxel Multiple Firewalls | vendor | – | – |
| zyxel zld | vendor | >= 5.00, <= 5.38 | – |
| zyxel zld | vendor | >= 5.10, <= 5.38 | – |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series firmware versions V5.00 through V5.38, USG FLEX 50(W) series firmware versions V5.10 through V5.38, and USG20(W)-VPN series firmware versions V5.10 through V5.38 could allow an attacker to download or upload files via a crafted URL.
This page as .md · .json · in your agent: get_signal("CVE-2024-11667")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.