CVE-2024-11667

Description

A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series firmware versions V5.00 through V5.38, USG FLEX 50(W) series firmware versions V5.10 through V5.38, and USG20(W)-VPN series firmware versions V5.10 through V5.38 could allow an attacker to download or upload files via a crafted URL.

Reserved 2024-11-25 | Published 2024-11-27 | Updated 2024-12-06 | Assigner Zyxel

CISA Known Exploited Vulnerability

Date added 2024-12-03 | Due date 2024-12-24

Known Ransomware Campaign(s)

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Problem types

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Product status

Default status
unaffected

versions V5.00 through V5.38
affected

Default status
unaffected

versions V5.00 through V5.38
affected

Default status
unaffected

versions V5.10 through V5.38
affected

Default status
unaffected

versions V5.10 through V5.38
affected

References

www.zyxel.com/...-against-recent-firewall-threats-11-27-2024 vendor-advisory

cve.org (CVE-2024-11667)

nvd.nist.gov (CVE-2024-11667)

Download JSON