{"id":"CVE-2024-11667","url":"https://www.cyber-defence.io/tools/cve/CVE-2024-11667","generatedAt":"2026-10-31T08:11:25.867Z","title":"Zyxel Multiple Firewalls Path Traversal Vulnerability","description":"A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series firmware versions V5.00 through V5.38, USG FLEX 50(W) series firmware versions V5.10 through V5.38, and USG20(W)-VPN series firmware versions V5.10 through V5.38 could allow an attacker to download or upload files via a crafted URL.","published":"2024-11-27T10:15:04.000Z","lastModified":"2026-08-05T05:16:41.000Z","status":"Analyzed","sourceIdentifier":"security@zyxel.com.tw","cvss":{"version":"3.1","score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-22"],"affected":["zyxel/zld"],"epss":{"score":0.02929,"percentile":0.8706,"date":"2026-10-30","history":[]},"kev":{"listed":true,"dateAdded":"2024-12-03","dueDate":"2024-12-24","knownRansomwareCampaignUse":"Known","notes":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.\nhttps://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-protecting-against-recent-firewall-threats-11-21-2024 ; https://nvd.nist.gov/vuln/detail/CVE-2024-11667"},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"urgent","text":"Known to be exploited in the wild (CISA KEV, CISA remediation deadline 24 December 2024). Treat as an emergency change: patch or isolate now, then hunt for prior compromise."},"changes":[],"references":[{"url":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-protecting-against-recent-firewall-threats-11-27-2024","tags":["Vendor Advisory"],"source":"security@zyxel.com.tw"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-11667","tags":["US Government Resource"],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2024-11667","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}