CVE-2024-11667 (GCVE-0-2024-11667)

Vulnerability from cvelistv5 – Published: 2024-11-27 09:39 – Updated: 2026-08-05 03:55
VLAI CISA Previdian
Summary
A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series firmware versions V5.00 through V5.38, USG FLEX 50(W) series firmware versions V5.10 through V5.38, and USG20(W)-VPN series firmware versions V5.10 through V5.38 could allow an attacker to download or upload files via a crafted URL.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
SSVC
Exploitation: active Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-12-05 00:00 UTC
CWE
  • CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
Impacted products
Vendor Product Version CPE status
Zyxel ATP series firmware Affected: versions V5.00 through V5.38
guessed Create a notification for this product.
Zyxel USG FLEX series firmware Affected: versions V5.00 through V5.38
guessed Create a notification for this product.
Zyxel USG FLEX 50(W) series firmware Affected: versions V5.10 through V5.38
guessed Create a notification for this product.
Zyxel USG20(W)-VPN series firmware Affected: versions V5.10 through V5.38
guessed Create a notification for this product.
zyxel usg_flex_firmware Affected: 5.00 , ≤ 5.38 (custom)
    cpe:2.3:o:zyxel:usg_flex_100h_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:zyxel:usg_flex_100hp_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:zyxel:usg_flex_100w_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:zyxel:usg_flex_200_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:zyxel:usg_flex_200h_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:zyxel:usg_flex_200hp_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:zyxel:usg_flex_500_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:zyxel:usg_flex_500h_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:zyxel:usg_flex_500w_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:zyxel:usg_flex_50ax_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:zyxel:usg_flex_50_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:zyxel:usg_flex_60ax_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:zyxel:usg_flex_700_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:zyxel:usg_flex_700h_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:zyxel:usg_flex_firmware:-:*:*:*:*:*:*:*
Create a notification for this product.
zyxel atp_firmware Affected: 5.00 , ≤ 5.38 (custom)
    cpe:2.3:o:zyxel:atp100_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:zyxel:atp100w_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:zyxel:atp500_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:zyxel:atp700_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:zyxel:atp800_firmware:-:*:*:*:*:*:*:*
    cpe:2.3:o:zyxel:atp_firmware:-:*:*:*:*:*:*:*
Create a notification for this product.
zyxel usg20-vpn_firmware Affected: 5.10 , ≤ 5.38 (custom)
    cpe:2.3:o:zyxel:usg20-vpn_firmware:-:*:*:*:*:*:*:*
Create a notification for this product.
zyxel usg_flex_50w_firmware Affected: 5.10 , < 5.38 (custom)
    cpe:2.3:o:zyxel:usg_flex_50w_firmware:-:*:*:*:*:*:*:*
Create a notification for this product.
CISA
Known Exploited Vulnerability - GCVE BCP-07 Compliant
KEV entry ID: 35edb18b-8e4a-4661-9d65-fe1d6bc3ddb4

Vulnerability ID: CVE-2024-11667

Status: Confirmed

Status Updated: 2024-12-03 00:00 UTC

Exploited: Yes

Timestamps
First Seen: 2024-12-03
Asserted: 2024-12-03
Scope
Notes: KEV entry: Zyxel Multiple Firewalls Path Traversal Vulnerability | Affected: Zyxel / Multiple Firewalls | Description: Multiple Zyxel firewalls contain a path traversal vulnerability in the web management interface that could allow an attacker to download or upload files via a crafted URL. | Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. | Due date: 2024-12-24 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-protecting-against-recent-firewall-threats-11-21-2024 ; https://nvd.nist.gov/vuln/detail/CVE-2024-11667
Evidence

Type: Vendor Report

Signal: Successful Exploitation

Confidence: 80%

Source: cisa-kev

Details
Cwes CWE-22
Feed CISA Known Exploited Vulnerabilities Catalog
Product Multiple Firewalls
Due Date 2024-12-24
Date Added 2024-12-03
Vendorproject Zyxel
Vulnerabilityname Zyxel Multiple Firewalls Path Traversal Vulnerability
Knownransomwarecampaignuse Known
References
Created: 2026-02-02 12:26 UTC | Updated: 2026-02-06 07:17 UTC
Previdian
Known Exploited Vulnerability - GCVE BCP-07 Compliant
KEV entry ID: 824cbaad-0cb6-4608-8e23-b755facceb98

Vulnerability ID: CVE-2024-11667

Status: Confirmed

Status Updated: 2024-12-03 00:00 UTC

Exploited: Yes

Timestamps
First Seen: 2024-12-03
Asserted: 2024-12-03
Scope
Notes: KEVIntel entry: A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series... | Affected: Zyxel / ATP series firmware, USG FLEX series firmware, USG FLEX 50(W) series firmware, USG20(W)-VPN series firmware | CVSS: 7.5 (HIGH) | Used in malware: yes | Not yet in CISA KEV: False
Evidence

Type: Public Report

Signal: Confirmed Compromise

Confidence: 70%

Source: kevintel

Details
Feed KEVIntel (kevintel.com)
Title A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series...
Vendor Zyxel
Product ATP series firmware, USG FLEX series firmware, USG FLEX 50(W) series firmware, USG20(W)-VPN series firmware
Added Date 2024-12-03T00:00:00.000Z
Cvss Score 7.5
Epss Score None
Cvss Severity HIGH
Epss Percentile None
Used In Malware yes
Ahead Of Cisa Kev None
Not Yet In Cisa Kev False
References
Created: 2026-06-23 14:06 UTC | Updated: 2026-07-10 06:14 UTC
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:zyxel:usg_flex_100h_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:usg_flex_100hp_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:usg_flex_100w_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:usg_flex_200_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:usg_flex_200h_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:usg_flex_200hp_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:usg_flex_500_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:usg_flex_500h_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:usg_flex_500w_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:usg_flex_50ax_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:usg_flex_50_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:usg_flex_60ax_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:usg_flex_700_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:usg_flex_700h_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:usg_flex_firmware:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "usg_flex_firmware",
            "vendor": "zyxel",
            "versions": [
              {
                "lessThanOrEqual": "5.38",
                "status": "affected",
                "version": "5.00",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:zyxel:atp100_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:atp100w_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:atp500_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:atp700_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:atp800_firmware:-:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:atp_firmware:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "atp_firmware",
            "vendor": "zyxel",
            "versions": [
              {
                "lessThanOrEqual": "5.38",
                "status": "affected",
                "version": "5.00",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:zyxel:usg20-vpn_firmware:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "usg20-vpn_firmware",
            "vendor": "zyxel",
            "versions": [
              {
                "lessThanOrEqual": "5.38",
                "status": "affected",
                "version": "5.10",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:zyxel:usg_flex_50w_firmware:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "usg_flex_50w_firmware",
            "vendor": "zyxel",
            "versions": [
              {
                "lessThan": "5.38",
                "status": "affected",
                "version": "5.10",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-11667",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-05T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2024-12-03",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-11667"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-05T03:55:55.854Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-11667"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2024-12-03T00:00:00.000Z",
            "value": "CVE-2024-11667 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ATP series firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "versions V5.00 through V5.38"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "USG FLEX series firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "versions V5.00 through V5.38"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "USG FLEX 50(W) series firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "versions V5.10 through V5.38"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "USG20(W)-VPN series firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "versions V5.10 through V5.38"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series firmware\u0026nbsp;versions V5.00 through V5.38,\u0026nbsp;USG FLEX 50(W) series firmware\u0026nbsp;versions V5.10 through V5.38, and\u0026nbsp;USG20(W)-VPN series firmware\u0026nbsp;versions V5.10 through V5.38 could allow an attacker to download or upload files via a crafted URL."
            }
          ],
          "value": "A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series firmware\u00a0versions V5.00 through V5.38,\u00a0USG FLEX 50(W) series firmware\u00a0versions V5.10 through V5.38, and\u00a0USG20(W)-VPN series firmware\u00a0versions V5.10 through V5.38 could allow an attacker to download or upload files via a crafted URL."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-28T02:11:49.265Z",
        "orgId": "96e50032-ad0d-4058-a115-4d2c13821f9f",
        "shortName": "Zyxel"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-protecting-against-recent-firewall-threats-11-27-2024"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "96e50032-ad0d-4058-a115-4d2c13821f9f",
    "assignerShortName": "Zyxel",
    "cveId": "CVE-2024-11667",
    "datePublished": "2024-11-27T09:39:41.691Z",
    "dateReserved": "2024-11-25T07:15:56.063Z",
    "dateUpdated": "2026-08-05T03:55:55.854Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "cisa_known_exploited": {
      "cveID": "CVE-2024-11667",
      "cwes": [
        "CWE-22"
      ],
      "dateAdded": "2024-12-03",
      "dueDate": "2024-12-24",
      "forensicTriage": "No",
      "knownRansomwareCampaignUse": "Known",
      "notes": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-protecting-against-recent-firewall-threats-11-21-2024 ; https://nvd.nist.gov/vuln/detail/CVE-2024-11667",
      "product": "Multiple Firewalls",
      "requiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
      "shortDescription": "Multiple Zyxel firewalls contain a path traversal vulnerability in the web management interface that could allow an attacker to download or upload files via a crafted URL.",
      "vendorProject": "Zyxel",
      "vulnerabilityName": "Zyxel Multiple Firewalls Path Traversal Vulnerability"
    },
    "epss": {
      "cve": "CVE-2024-11667",
      "date": "2026-09-26",
      "epss": "0.02929",
      "percentile": "0.86548"
    },
    "fkie_nvd": {
      "cisaActionDue": "2024-12-24",
      "cisaExploitAdd": "2024-12-03",
      "cisaRequiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
      "cisaVulnerabilityName": "Zyxel Multiple Firewalls Path Traversal Vulnerability",
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:zyxel:zld:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "18B592F1-F584-4573-AD75-398CE03F6627",
                  "versionEndIncluding": "5.38",
                  "versionStartIncluding": "5.00",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:h:zyxel:atp:-:*:*:*:*:*:*:*",
                  "matchCriteriaId": "788B28B2-E2EE-4D98-8862-15B121009B6E",
                  "vulnerable": false
                },
                {
                  "criteria": "cpe:2.3:h:zyxel:atp100:-:*:*:*:*:*:*:*",
                  "matchCriteriaId": "7F7654A1-3806-41C7-82D4-46B0CD7EE53B",
                  "vulnerable": false
                },
                {
                  "criteria": "cpe:2.3:h:zyxel:atp100w:-:*:*:*:*:*:*:*",
                  "matchCriteriaId": "47398FD0-6C5E-4625-9EFD-DE08C9AB7DB2",
                  "vulnerable": false
                },
                {
                  "criteria": "cpe:2.3:h:zyxel:atp200:-:*:*:*:*:*:*:*",
                  "matchCriteriaId": "D68A36FF-8CAF-401C-9F18-94F3A2405CF4",
                  "vulnerable": false
                },
                {
                  "criteria": "cpe:2.3:h:zyxel:atp500:-:*:*:*:*:*:*:*",
                  "matchCriteriaId": "2818E8AC-FFEE-4DF9-BF3F-C75166C0E851",
                  "vulnerable": false
                },
                {
                  "criteria": "cpe:2.3:h:zyxel:atp700:-:*:*:*:*:*:*:*",
                  "matchCriteriaId": "0B41F437-855B-4490-8011-DF59887BE6D5",
                  "vulnerable": false
                },
                {
                  "criteria": "cpe:2.3:h:zyxel:atp800:-:*:*:*:*:*:*:*",
                  "matchCriteriaId": "66B99746-0589-46E6-9CBD-F38619AD97DC",
                  "vulnerable": false
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:zyxel:zld:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "18B592F1-F584-4573-AD75-398CE03F6627",
                  "versionEndIncluding": "5.38",
                  "versionStartIncluding": "5.00",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:h:zyxel:usg_flex:-:*:*:*:*:*:*:*",
                  "matchCriteriaId": "E4EDCC3C-8EE5-43D3-8739-34987F025DF2",
                  "vulnerable": false
                },
                {
                  "criteria": "cpe:2.3:h:zyxel:usg_flex_100:-:*:*:*:*:*:*:*",
                  "matchCriteriaId": "2B30A4C0-9928-46AD-9210-C25656FB43FB",
                  "vulnerable": false
                },
                {
                  "criteria": "cpe:2.3:h:zyxel:usg_flex_100ax:-:*:*:*:*:*:*:*",
                  "matchCriteriaId": "03036815-04AE-4E39-8310-DA19A32CFA48",
                  "vulnerable": false
                },
                {
                  "criteria": "cpe:2.3:h:zyxel:usg_flex_100w:-:*:*:*:*:*:*:*",
                  "matchCriteriaId": "D74ABA7E-AA78-4A13-A64E-C44021591B42",
                  "vulnerable": false
                },
                {
                  "criteria": "cpe:2.3:h:zyxel:usg_flex_200:-:*:*:*:*:*:*:*",
                  "matchCriteriaId": "F93B6A06-2951-46D2-A7E1-103D7318D612",
                  "vulnerable": false
                },
                {
                  "criteria": "cpe:2.3:h:zyxel:usg_flex_50:-:*:*:*:*:*:*:*",
                  "matchCriteriaId": "646C1F07-B553-47B0-953B-DC7DE7FD0F8B",
                  "vulnerable": false
                },
                {
                  "criteria": "cpe:2.3:h:zyxel:usg_flex_500:-:*:*:*:*:*:*:*",
                  "matchCriteriaId": "92C697A5-D1D3-4FF0-9C43-D27B18181958",
                  "vulnerable": false
                },
                {
                  "criteria": "cpe:2.3:h:zyxel:usg_flex_700:-:*:*:*:*:*:*:*",
                  "matchCriteriaId": "9D1396E3-731B-4D05-A3F8-F3ABB80D5C29",
                  "vulnerable": false
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:zyxel:zld:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "CBEE7B76-74EB-4570-9A5B-071BA9E36DB9",
                  "versionEndIncluding": "5.38",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:h:zyxel:usg_flex_50w:-:*:*:*:*:*:*:*",
                  "matchCriteriaId": "110A1CA4-0170-4834-8281-0A3E14FC5584",
                  "vulnerable": false
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:zyxel:zld:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "CBEE7B76-74EB-4570-9A5B-071BA9E36DB9",
                  "versionEndIncluding": "5.38",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:h:zyxel:usg_20w-vpn:-:*:*:*:*:*:*:*",
                  "matchCriteriaId": "6BEA412F-3DA1-4E91-9C74-0666147DABCE",
                  "vulnerable": false
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series firmware\u00a0versions V5.00 through V5.38,\u00a0USG FLEX 50(W) series firmware\u00a0versions V5.10 through V5.38, and\u00a0USG20(W)-VPN series firmware\u00a0versions V5.10 through V5.38 could allow an attacker to download or upload files via a crafted URL."
        },
        {
          "lang": "es",
          "value": "Una vulnerabilidad de directory traversal en la interfaz de administraci\u00f3n web de las versiones de firmware de la serie Zyxel ATP V5.00 a V5.38, las versiones de firmware de la serie USG FLEX V5.00 a V5.38, las versiones de firmware de la serie USG FLEX 50(W) V5.10 a V5.38 y las versiones de firmware de la serie USG20(W)-VPN V5.10 a V5.38 podr\u00eda permitir que un atacante descargue o cargue archivos a trav\u00e9s de una URL manipulada espec\u00edficamente."
        }
      ],
      "id": "CVE-2024-11667",
      "lastModified": "2024-12-05T18:41:12.113",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            },
            "exploitabilityScore": 3.9,
            "impactScore": 3.6,
            "source": "security@zyxel.com.tw",
            "type": "Secondary"
          },
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 3.9,
            "impactScore": 5.9,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2024-11-27T10:15:04.210",
      "references": [
        {
          "source": "security@zyxel.com.tw",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-protecting-against-recent-firewall-threats-11-27-2024"
        }
      ],
      "sourceIdentifier": "security@zyxel.com.tw",
      "vulnStatus": "Analyzed",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-22"
            }
          ],
          "source": "security@zyxel.com.tw",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "ATP series firmware",
                "vendor": "Zyxel",
                "versions": [
                  {
                    "status": "affected",
                    "version": "versions V5.00 through V5.38"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "USG FLEX series firmware",
                "vendor": "Zyxel",
                "versions": [
                  {
                    "status": "affected",
                    "version": "versions V5.00 through V5.38"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "USG FLEX 50(W) series firmware",
                "vendor": "Zyxel",
                "versions": [
                  {
                    "status": "affected",
                    "version": "versions V5.10 through V5.38"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "USG20(W)-VPN series firmware",
                "vendor": "Zyxel",
                "versions": [
                  {
                    "status": "affected",
                    "version": "versions V5.10 through V5.38"
                  }
                ]
              }
            ],
            "source": "security@zyxel.com.tw"
          },
          {
            "affectedData": [
              {
                "cpes": [
                  "cpe:2.3:o:zyxel:usg_flex_100h_firmware:*:*:*:*:*:*:*:*",
                  "cpe:2.3:o:zyxel:usg_flex_100hp_firmware:*:*:*:*:*:*:*:*",
                  "cpe:2.3:o:zyxel:usg_flex_100w_firmware:*:*:*:*:*:*:*:*",
                  "cpe:2.3:o:zyxel:usg_flex_200_firmware:*:*:*:*:*:*:*:*",
                  "cpe:2.3:o:zyxel:usg_flex_200h_firmware:*:*:*:*:*:*:*:*",
                  "cpe:2.3:o:zyxel:usg_flex_200hp_firmware:*:*:*:*:*:*:*:*",
                  "cpe:2.3:o:zyxel:usg_flex_500_firmware:*:*:*:*:*:*:*:*",
                  "cpe:2.3:o:zyxel:usg_flex_500h_firmware:*:*:*:*:*:*:*:*",
                  "cpe:2.3:o:zyxel:usg_flex_500w_firmware:*:*:*:*:*:*:*:*",
                  "cpe:2.3:o:zyxel:usg_flex_50ax_firmware:*:*:*:*:*:*:*:*",
                  "cpe:2.3:o:zyxel:usg_flex_50_firmware:*:*:*:*:*:*:*:*",
                  "cpe:2.3:o:zyxel:usg_flex_60ax_firmware:*:*:*:*:*:*:*:*",
                  "cpe:2.3:o:zyxel:usg_flex_700_firmware:*:*:*:*:*:*:*:*",
                  "cpe:2.3:o:zyxel:usg_flex_700h_firmware:*:*:*:*:*:*:*:*",
                  "cpe:2.3:o:zyxel:usg_flex_firmware:-:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "usg_flex_firmware",
                "vendor": "zyxel",
                "versions": [
                  {
                    "lessThanOrEqual": "5.38",
                    "status": "affected",
                    "version": "5.00",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:o:zyxel:atp100_firmware:*:*:*:*:*:*:*:*",
                  "cpe:2.3:o:zyxel:atp100w_firmware:*:*:*:*:*:*:*:*",
                  "cpe:2.3:o:zyxel:atp500_firmware:*:*:*:*:*:*:*:*",
                  "cpe:2.3:o:zyxel:atp700_firmware:*:*:*:*:*:*:*:*",
                  "cpe:2.3:o:zyxel:atp800_firmware:-:*:*:*:*:*:*:*",
                  "cpe:2.3:o:zyxel:atp_firmware:-:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "atp_firmware",
                "vendor": "zyxel",
                "versions": [
                  {
                    "lessThanOrEqual": "5.38",
                    "status": "affected",
                    "version": "5.00",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:o:zyxel:usg20-vpn_firmware:-:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "usg20-vpn_firmware",
                "vendor": "zyxel",
                "versions": [
                  {
                    "lessThanOrEqual": "5.38",
                    "status": "affected",
                    "version": "5.10",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:o:zyxel:usg_flex_50w_firmware:-:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "usg_flex_50w_firmware",
                "vendor": "zyxel",
                "versions": [
                  {
                    "lessThan": "5.38",
                    "status": "affected",
                    "version": "5.10",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
          }
        ],
        "cisaActionDue": "2024-12-24",
        "cisaExploitAdd": "2024-12-03",
        "cisaRequiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
        "cisaVulnerabilityName": "Zyxel Multiple Firewalls Path Traversal Vulnerability",
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:zyxel:zld:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "18B592F1-F584-4573-AD75-398CE03F6627",
                    "versionEndIncluding": "5.38",
                    "versionStartIncluding": "5.00",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:zyxel:atp:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "788B28B2-E2EE-4D98-8862-15B121009B6E",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:zyxel:atp100:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7F7654A1-3806-41C7-82D4-46B0CD7EE53B",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:zyxel:atp100w:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "47398FD0-6C5E-4625-9EFD-DE08C9AB7DB2",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:zyxel:atp200:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D68A36FF-8CAF-401C-9F18-94F3A2405CF4",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:zyxel:atp500:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2818E8AC-FFEE-4DF9-BF3F-C75166C0E851",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:zyxel:atp700:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "0B41F437-855B-4490-8011-DF59887BE6D5",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:zyxel:atp800:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "66B99746-0589-46E6-9CBD-F38619AD97DC",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:zyxel:zld:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "18B592F1-F584-4573-AD75-398CE03F6627",
                    "versionEndIncluding": "5.38",
                    "versionStartIncluding": "5.00",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:zyxel:usg_flex:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E4EDCC3C-8EE5-43D3-8739-34987F025DF2",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:zyxel:usg_flex_100:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2B30A4C0-9928-46AD-9210-C25656FB43FB",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:zyxel:usg_flex_100ax:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "03036815-04AE-4E39-8310-DA19A32CFA48",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:zyxel:usg_flex_100w:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D74ABA7E-AA78-4A13-A64E-C44021591B42",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:zyxel:usg_flex_200:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F93B6A06-2951-46D2-A7E1-103D7318D612",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:zyxel:usg_flex_50:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "646C1F07-B553-47B0-953B-DC7DE7FD0F8B",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:zyxel:usg_flex_500:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "92C697A5-D1D3-4FF0-9C43-D27B18181958",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:zyxel:usg_flex_700:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9D1396E3-731B-4D05-A3F8-F3ABB80D5C29",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:zyxel:zld:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CBEE7B76-74EB-4570-9A5B-071BA9E36DB9",
                    "versionEndIncluding": "5.38",
                    "versionStartIncluding": "5.10",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:zyxel:usg_flex_50w:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "110A1CA4-0170-4834-8281-0A3E14FC5584",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:zyxel:zld:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CBEE7B76-74EB-4570-9A5B-071BA9E36DB9",
                    "versionEndIncluding": "5.38",
                    "versionStartIncluding": "5.10",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:zyxel:usg_20w-vpn:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6BEA412F-3DA1-4E91-9C74-0666147DABCE",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series firmware\u00a0versions V5.00 through V5.38,\u00a0USG FLEX 50(W) series firmware\u00a0versions V5.10 through V5.38, and\u00a0USG20(W)-VPN series firmware\u00a0versions V5.10 through V5.38 could allow an attacker to download or upload files via a crafted URL."
          },
          {
            "lang": "es",
            "value": "Una vulnerabilidad de directory traversal en la interfaz de administraci\u00f3n web de las versiones de firmware de la serie Zyxel ATP V5.00 a V5.38, las versiones de firmware de la serie USG FLEX V5.00 a V5.38, las versiones de firmware de la serie USG FLEX 50(W) V5.10 a V5.38 y las versiones de firmware de la serie USG20(W)-VPN V5.10 a V5.38 podr\u00eda permitir que un atacante descargue o cargue archivos a trav\u00e9s de una URL manipulada espec\u00edficamente."
          }
        ],
        "id": "CVE-2024-11667",
        "lastModified": "2026-08-05T05:16:40.797",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "security@zyxel.com.tw",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-11667",
                "options": [
                  {
                    "exploitation": "active"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-05T00:00:00+00:00",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-11-27T10:15:04.210",
        "references": [
          {
            "source": "security@zyxel.com.tw",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-protecting-against-recent-firewall-threats-11-27-2024"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "tags": [
              "US Government Resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-11667"
          }
        ],
        "sourceIdentifier": "security@zyxel.com.tw",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-22"
              }
            ],
            "source": "security@zyxel.com.tw",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-03-27T10:33:40+00:00",
      "cve": "CVE-2024-11667",
      "id": "CVE-2024-11667",
      "initial_release_date": "2024-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "CVE-2024-11667",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-11667.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "affected": [
              {
                "cpes": [
                  "cpe:2.3:o:zyxel:usg_flex_100h_firmware:*:*:*:*:*:*:*:*",
                  "cpe:2.3:o:zyxel:usg_flex_100hp_firmware:*:*:*:*:*:*:*:*",
                  "cpe:2.3:o:zyxel:usg_flex_100w_firmware:*:*:*:*:*:*:*:*",
                  "cpe:2.3:o:zyxel:usg_flex_200_firmware:*:*:*:*:*:*:*:*",
                  "cpe:2.3:o:zyxel:usg_flex_200h_firmware:*:*:*:*:*:*:*:*",
                  "cpe:2.3:o:zyxel:usg_flex_200hp_firmware:*:*:*:*:*:*:*:*",
                  "cpe:2.3:o:zyxel:usg_flex_500_firmware:*:*:*:*:*:*:*:*",
                  "cpe:2.3:o:zyxel:usg_flex_500h_firmware:*:*:*:*:*:*:*:*",
                  "cpe:2.3:o:zyxel:usg_flex_500w_firmware:*:*:*:*:*:*:*:*",
                  "cpe:2.3:o:zyxel:usg_flex_50ax_firmware:*:*:*:*:*:*:*:*",
                  "cpe:2.3:o:zyxel:usg_flex_50_firmware:*:*:*:*:*:*:*:*",
                  "cpe:2.3:o:zyxel:usg_flex_60ax_firmware:*:*:*:*:*:*:*:*",
                  "cpe:2.3:o:zyxel:usg_flex_700_firmware:*:*:*:*:*:*:*:*",
                  "cpe:2.3:o:zyxel:usg_flex_700h_firmware:*:*:*:*:*:*:*:*",
                  "cpe:2.3:o:zyxel:usg_flex_firmware:-:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "usg_flex_firmware",
                "vendor": "zyxel",
                "versions": [
                  {
                    "lessThanOrEqual": "5.38",
                    "status": "affected",
                    "version": "5.00",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:o:zyxel:atp100_firmware:*:*:*:*:*:*:*:*",
                  "cpe:2.3:o:zyxel:atp100w_firmware:*:*:*:*:*:*:*:*",
                  "cpe:2.3:o:zyxel:atp500_firmware:*:*:*:*:*:*:*:*",
                  "cpe:2.3:o:zyxel:atp700_firmware:*:*:*:*:*:*:*:*",
                  "cpe:2.3:o:zyxel:atp800_firmware:-:*:*:*:*:*:*:*",
                  "cpe:2.3:o:zyxel:atp_firmware:-:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "atp_firmware",
                "vendor": "zyxel",
                "versions": [
                  {
                    "lessThanOrEqual": "5.38",
                    "status": "affected",
                    "version": "5.00",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:o:zyxel:usg20-vpn_firmware:-:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "usg20-vpn_firmware",
                "vendor": "zyxel",
                "versions": [
                  {
                    "lessThanOrEqual": "5.38",
                    "status": "affected",
                    "version": "5.10",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:o:zyxel:usg_flex_50w_firmware:-:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "usg_flex_50w_firmware",
                "vendor": "zyxel",
                "versions": [
                  {
                    "lessThan": "5.38",
                    "status": "affected",
                    "version": "5.10",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-11667",
                    "options": [
                      {
                        "Exploitation": "active"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-12-06T04:55:26.617036Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              },
              {
                "other": {
                  "content": {
                    "dateAdded": "2024-12-03",
                    "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-11667"
                  },
                  "type": "kev"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-11-27T14:39:41.140Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "government-resource"
                ],
                "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-11667"
              }
            ],
            "timeline": [
              {
                "lang": "en",
                "time": "2024-12-03T00:00:00.000Z",
                "value": "CVE-2024-11667 added to CISA KEV"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "ATP series firmware",
              "vendor": "Zyxel",
              "versions": [
                {
                  "status": "affected",
                  "version": "versions V5.00 through V5.38"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "USG FLEX series firmware",
              "vendor": "Zyxel",
              "versions": [
                {
                  "status": "affected",
                  "version": "versions V5.00 through V5.38"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "USG FLEX 50(W) series firmware",
              "vendor": "Zyxel",
              "versions": [
                {
                  "status": "affected",
                  "version": "versions V5.10 through V5.38"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "USG20(W)-VPN series firmware",
              "vendor": "Zyxel",
              "versions": [
                {
                  "status": "affected",
                  "version": "versions V5.10 through V5.38"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series firmware\u0026nbsp;versions V5.00 through V5.38,\u0026nbsp;USG FLEX 50(W) series firmware\u0026nbsp;versions V5.10 through V5.38, and\u0026nbsp;USG20(W)-VPN series firmware\u0026nbsp;versions V5.10 through V5.38 could allow an attacker to download or upload files via a crafted URL."
                }
              ],
              "value": "A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series firmware\u00a0versions V5.00 through V5.38,\u00a0USG FLEX 50(W) series firmware\u00a0versions V5.10 through V5.38, and\u00a0USG20(W)-VPN series firmware\u00a0versions V5.10 through V5.38 could allow an attacker to download or upload files via a crafted URL."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-22",
                  "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2024-11-28T02:11:49.265Z",
            "orgId": "96e50032-ad0d-4058-a115-4d2c13821f9f",
            "shortName": "Zyxel"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-protecting-against-recent-firewall-threats-11-27-2024"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "x_generator": {
            "engine": "Vulnogram 0.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "96e50032-ad0d-4058-a115-4d2c13821f9f",
        "assignerShortName": "Zyxel",
        "cveId": "CVE-2024-11667",
        "datePublished": "2024-11-27T09:39:41.691Z",
        "dateReserved": "2024-11-25T07:15:56.063Z",
        "dateUpdated": "2026-08-05T03:55:55.854Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.