{"id":"CVE-2024-11667","kind":"vulnerability","aliases":["CVE-2024-11667"],"related":[],"title":"zyxel zld: A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00…","description":"A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series firmware versions V5.00 through V5.38, USG FLEX 50(W) series firmware versions V5.10 through V5.38, and USG20(W)-VPN series firmware versions V5.10 through V5.38 could allow an attacker to download or upload files via a crafted URL.","summary":"Multiple Zyxel firewalls have a path traversal flaw in the web management interface that lets a crafted URL download or upload arbitrary files. CISA lists it as known exploited, and the sources note ransomware use.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2024-12-03T00:00:00+00:00","products":[{"name":"Zyxel Multiple Firewalls","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"zyxel zld","fixed":[],"affected":">= 5.00, <= 5.38","ecosystem":"vendor"},{"name":"zyxel zld","fixed":[],"affected":">= 5.10, <= 5.38","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","firewall","infrastructure","ransomware","self-hosted","web-management","zyxel"],"not_affected_if":["default-config"],"how_to_check":"Check the firmware version on each Zyxel firewall against the vendor advisory. Confirm whether the web management interface is reachable from the internet. unknown for the exact affected version list.","fix":"Apply the vendor mitigation or patch for your firmware version per Zyxel's advisory. If no mitigation is available, discontinue use of the product as CISA requires.","status":"open","published_at":"2024-11-27T10:15:04+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:56:04+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T20:56:04Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigation or patch for your firmware version per Zyxel's advisory. If no mitigation is available, discontinue use of the product as CISA requires.","reach":"internet","impact":"high","summary":"Multiple Zyxel firewalls have a path traversal flaw in the web management interface that lets a crafted URL download or upload arbitrary files. CISA lists it as known exploited, and the sources note ransomware use.","category":"infrastructure","who_cares":["zyxel","firewall","self-hosted","web-management"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker reads or writes arbitrary files on the firewall, possibly taking it over.","analyst_note":"Find the Zyxel advisory and exact affected and fixed firmware versions, plus whether the web management interface must be exposed for exploitation.","how_to_check":"Check the firmware version on each Zyxel firewall against the vendor advisory. Confirm whether the web management interface is reachable from the internet. unknown for the exact affected version list.","needs_analyst":true,"not_affected_if":["default-config"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000495,"input_tokens":2833,"output_tokens":423,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-11667':21A,24A '-2024':20A,23A '50':106C 'allow':125C 'arbitrari':64B 'atp':14A,89C 'attack':127C 'cisa':66B 'could':124C 'craft':59B,135C 'cve':19A,22A 'directori':4A,79C 'download':61B,129C 'exploit':32B,71B 'file':65B,132C 'firewal':33B,45B 'firewalls':27A 'firmwar':16A,91C,99C,109C,119C 'flaw':50B 'flex':97C,105C 'host':38B 'infrastructur':34B 'interfac':11A,55B,86C 'known':70B 'let':57B 'list':67B 'manag':10A,41B,54B,85C 'multipl':43B 'multiple':26A 'note':75B 'path':48B 'ransomwar':35B,76B 'self':37B 'self-host':36B 'seri':15A,90C,98C,108C,118C 'sourc':74B 'travers':5A,49B,80C 'upload':63B,131C 'url':60B,136C 'use':77B 'usg':96C,104C 'usg20':115C 'v5.00':18A,93C,101C 'v5.10':111C,121C 'v5.38':95C,103C,113C,123C 'version':17A,92C,100C,110C,120C 'via':133C 'vpn':117C 'vulner':6A,81C 'w':107C,116C 'web':9A,40B,53B,84C 'web-manag':39B 'zld':2A,29A,31A 'zyxel':1A,13A,25A,28A,30A,42B,44B,88C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2024-11-27T10:15:04+00:00","kev":{"dateAdded":"2024-12-03","dueDate":"2024-12-24","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security@zyxel.com.tw","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2024-11667","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-11667","severity":null,"published_at":"2024-12-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T10:39:05+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-11667","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-11667","severity":null,"published_at":"2024-11-27T10:15:04+00:00","modified_at":"2026-08-05T05:16:40+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}