---
id: "CVE-2024-11667"
kind: "vulnerability"
aliases: ["CVE-2024-11667"]
title: "zyxel zld: A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00\u2026"
severity: "critical"
cvss: 9.8
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Zyxel Multiple Firewalls", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "zyxel zld", "fixed": [], "affected": ">= 5.00, <= 5.38", "ecosystem": "vendor"}, {"name": "zyxel zld", "fixed": [], "affected": ">= 5.10, <= 5.38", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "firewall", "infrastructure", "ransomware", "self-hosted", "web-management", "zyxel"]
not_affected_if: ["default-config"]
published_at: "2024-11-27T10:15:04+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:05+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-11667", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11667", "first_seen_at": "2026-10-23T22:29:05+00:00"}]
---

# zyxel zld: A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00…

Multiple Zyxel firewalls have a path traversal flaw in the web management interface that lets a crafted URL download or upload arbitrary files. CISA lists it as known exploited, and the sources note ransomware use.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Zyxel Multiple Firewalls affected ? fixed ?
- vendor:zyxel zld affected >= 5.00, <= 5.38 fixed ?
- vendor:zyxel zld affected >= 5.10, <= 5.38 fixed ?

## How to check

Check the firmware version on each Zyxel firewall against the vendor advisory. Confirm whether the web management interface is reachable from the internet. unknown for the exact affected version list.

## Fix

Apply the vendor mitigation or patch for your firmware version per Zyxel's advisory. If no mitigation is available, discontinue use of the product as CISA requires.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-11667
- 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2024-11667

## From the sources

A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series firmware versions V5.00 through V5.38, USG FLEX 50(W) series firmware versions V5.10 through V5.38, and USG20(W)-VPN series firmware versions V5.10 through V5.38 could allow an attacker to download or upload files via a crafted URL.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_