CVE-2024-11667: Zyxel Firewall Path Traversal (KEV)

CVE-2024-11667 is a directory traversal vulnerability in the web management interface of Zyxel ATP and USG FLEX series firewall firmware that lets an attacker download or upload files via a crafted URL, and CISA's KEV catalog records it as having known use in ransomware campaigns.

CVE-2024-11667 (CWE-22, path traversal) affects the web management interface of Zyxel firewall firmware (ZLD) on the ATP series, USG FLEX series, USG FLEX 50(W) series, and USG20(W)-VPN series, versions 5.00 through 5.38. A crafted URL lets an attacker traverse outside the intended directory to download or upload files on the device (NVD).

Scoring for this CVE differs by source. NVD's own analysis gives it CVSS v3.1 9.8 (critical) — network-reachable, low attack complexity, no privileges or user interaction required, full confidentiality/integrity/availability impact (vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Zyxel's own CNA submission scores it lower, CVSS v3.1 7.5 (high), reflecting a confidentiality-only impact (vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) — a CNA-reported figure, not an NVD-confirmed one (NVD).

Zyxel's security advisory confirms the affected firmware range (ZLD 5.00 through 5.38) and states the issue, along with related vulnerabilities, is fixed in ZLD 5.39, released 2024-09-03; firmware 5.39 and later are described as "immune to the mentioned exploitation." The advisory was issued after Zyxel observed "recent attempts by threat actors to target Zyxel firewalls through previously disclosed vulnerabilities" and recommends updating firmware immediately, temporarily disabling remote (WAN) management access to the device if an update cannot be applied right away, and changing admin passwords as a precaution (Zyxel Security Advisory).

CISA added CVE-2024-11667 to the Known Exploited Vulnerabilities (KEV) catalog on 2024-12-03, with a required-action due date of 2024-12-24, and the catalog records known use in ransomware campaigns (CISA KEV).

As of 2026-10-20, FIRST scores the probability of exploitation at 0.0293 (86.897th percentile) — moderate relative to the full EPSS distribution, though the confirmed ransomware use means exposed, unpatched devices still carry real risk (FIRST EPSS).

Any affected Zyxel firewall on firmware 5.00-5.38 should be updated to 5.39 or later immediately; if that is not immediately possible, disable WAN access to the management interface and rotate admin credentials as an interim measure.

• Directory traversal in the web management interface of Zyxel ATP/USG FLEX/USG FLEX 50(W)/USG20(W)-VPN firmware (ZLD 5.00-5.38) lets an attacker download or upload files via a crafted URL. — NVD
• NVD CVSS v3.1 base score is 9.8 (critical); Zyxel's own CNA-submitted score is 7.5 (high) — a CNA-reported figure, not NVD-confirmed. — NVD
• Affected ZLD firmware 5.00 through 5.38, fixed in 5.39 (released 2024-09-03); recommended mitigations are updating firmware, temporarily disabling WAN management access, and changing admin passwords. — Zyxel Security Advisory
• Added to the CISA Known Exploited Vulnerabilities catalog on 2024-12-03, due date 2024-12-24, with known ransomware campaign use. — CISA KEV
• EPSS score is 0.0293 (86.897th percentile) as of 2026-10-20. — FIRST EPSS