CVE-2024-11667 is a directory traversal vulnerability in the web management interface of Zyxel ATP and USG FLEX series firewall firmware that lets an attacker download or upload files via a crafted URL, and CISA's KEV catalog records it as having known use in ransomware campaigns.
Vulnerability summary
CVSS base score
9.8
Critical severity
EPSS score (FIRST)
2.9%
Probability of exploitation in the wild in the next 30 days
CISA KEV catalog
Yes
Listed as known exploited
Published
Vulnerability ID: CVE-2024-11667 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Zyxel ZLD firmware (ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN series firewalls) | cpe:2.3:o:zyxel:zld:*:*:*:*:*:*:*:* | 5.00 through 5.38 (fixed in 5.39) |
What does this mean for affected devices?
CVE-2024-11667 (CWE-22, path traversal) affects the web management interface of Zyxel firewall firmware (ZLD) on the ATP series, USG FLEX series, USG FLEX 50(W) series, and USG20(W)-VPN series, versions 5.00 through 5.38. A crafted URL lets an attacker traverse outside the intended directory to download or upload files on the device (NVD).
Scoring for this CVE differs by source. NVD's own analysis gives it CVSS v3.1 9.8 (critical) — network-reachable, low attack complexity, no privileges or user interaction required, full confidentiality/integrity/availability impact (vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Zyxel's own CNA submission scores it lower, CVSS v3.1 7.5 (high), reflecting a confidentiality-only impact (vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) — a CNA-reported figure, not an NVD-confirmed one (NVD).
Zyxel's security advisory confirms the affected firmware range (ZLD 5.00 through 5.38) and states the issue, along with related vulnerabilities, is fixed in ZLD 5.39, released 2024-09-03; firmware 5.39 and later are described as "immune to the mentioned exploitation." The advisory was issued after Zyxel observed "recent attempts by threat actors to target Zyxel firewalls through previously disclosed vulnerabilities" and recommends updating firmware immediately, temporarily disabling remote (WAN) management access to the device if an update cannot be applied right away, and changing admin passwords as a precaution (Zyxel Security Advisory).
CISA added CVE-2024-11667 to the Known Exploited Vulnerabilities (KEV) catalog on 2024-12-03, with a required-action due date of 2024-12-24, and the catalog records known use in ransomware campaigns (CISA KEV).
As of 2026-10-20, FIRST scores the probability of exploitation at 0.0293 (86.897th percentile) — moderate relative to the full EPSS distribution, though the confirmed ransomware use means exposed, unpatched devices still carry real risk (FIRST EPSS).
Any affected Zyxel firewall on firmware 5.00-5.38 should be updated to 5.39 or later immediately; if that is not immediately possible, disable WAN access to the management interface and rotate admin credentials as an interim measure.
Evidence
- Directory traversal in the web management interface of Zyxel ATP/USG FLEX/USG FLEX 50(W)/USG20(W)-VPN firmware (ZLD 5.00-5.38) lets an attacker download or upload files via a crafted URL. — NVD
- NVD CVSS v3.1 base score is 9.8 (critical); Zyxel's own CNA-submitted score is 7.5 (high) — a CNA-reported figure, not NVD-confirmed. — NVD
- Affected ZLD firmware 5.00 through 5.38, fixed in 5.39 (released 2024-09-03); recommended mitigations are updating firmware, temporarily disabling WAN management access, and changing admin passwords. — Zyxel Security Advisory
- Added to the CISA Known Exploited Vulnerabilities catalog on 2024-12-03, due date 2024-12-24, with known ransomware campaign use. — CISA KEV
- EPSS score is 0.0293 (86.897th percentile) as of 2026-10-20. — FIRST EPSS
Related advisories
Sources
Frequently asked questions
How much lower is Zyxel's own severity score for CVE-2024-11667 compared to NVD's?
Zyxel's CNA submission scores CVE-2024-11667 at CVSS v3.1 7.5 (high), reflecting a confidentiality-only impact, while NVD's own analysis rates the same flaw 9.8 (critical) with full confidentiality, integrity and availability impact — a 2.3-point gap between the vendor-submitted and NVD-confirmed scores, per NVD.
What prompted Zyxel to publish its security advisory covering CVE-2024-11667?
Zyxel states its advisory was issued after the company observed "recent attempts by threat actors to target Zyxel firewalls through previously disclosed vulnerabilities," rather than as a routine, unprompted disclosure, per Zyxel Security Advisory.
What interim step does Zyxel recommend if a device affected by CVE-2024-11667 can't be updated right away?
Zyxel recommends temporarily disabling remote (WAN) management access to the device if firmware 5.39 cannot be applied immediately, and rotating admin passwords as a precaution, per Zyxel Security Advisory.
Does CVE-2024-11667's EPSS score reflect low practical risk despite confirmed ransomware use?
Its EPSS score of 0.0293 (86.897th percentile) as of 2026-10-20 is moderate relative to the full distribution of scored CVEs, not top-tier — but the CISA KEV catalog still records known ransomware-campaign use of this flaw, so exposed, unpatched devices carry real risk despite the moderate percentile, per FIRST EPSS and CISA KEV.
Questions about this page?