Background exploitation KEV catalog Ransomware No authentication

CVE-2024-11667

Zyxel Multiple Firewalls Path Traversal Vulnerability

CheckOps priority index

5.5/10 Patch within 7 days

Severity7.5

Probability0.3

Exploitation4/5

Severity = CVSS. Probability = EPSS (FIRST). Exploitation = public signals: KEV, EUVD, ransomware, EPSS above 10 %, no account required.

EPSS · today 2.9% higher than 87.1% of CVEs

CVSS 3.1 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:

Exploited for 700 days 03 Dec 2024

CISA due date 24 Dec 2024 for US federal agencies

Exploitation probability EPSS · FIRST

EPSS probability (%)Percentile among all CVEs

Exploitation signals 4 / 5

KEV catalog (CISA)03 Dec 2024
Exploited in EUVD (ENISA)03 Dec 2024
Used by ransomwareyes
EPSS above 10 %2.9%
No account, over the networkyes

What to do

Fix

Apply the vendor’s fix as soon as it is available.

CISA guidance: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Meanwhile

Take the service off the internet or restrict access to it, watch the logs and look for signs of compromise.

Manufacturers (CRA)

Exploited vulnerability in your product: early warning to ENISA within 24 h, then notification within 72 h (Article 14 of the Cyber Resilience Act). The CRA explained

Description ENISA EUVD

A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series firmware versions V5.00 through V5.38, USG FLEX 50(W) series firmware versions V5.10 through V5.38, and USG20(W)-VPN series firmware versions V5.10 through V5.38 could allow an attacker to download or upload files via a crafted URL.

Affected products

USG FLEX 50(W) series firmwareUSG FLEX series firmwareUSG20(W)-VPN series firmwareATP series firmwareMultiple Firewalls

Affected versions

versions V5.10 through V5.38
versions V5.00 through V5.38

Weaknesses (CWE)

CWE-22

Open source packages OSV

Affected libraries according to OSV, with fixed versions.

Timeline

27 Nov 2024
Published
03 Dec 2024
Exploitation reported (ENISA)
03 Dec 2024
Added to the KEV catalog
24 Dec 2024
CISA remediation due date

References

Other exploited vulnerabilities from the same vendor

CVE-2026-7273Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability
4.8 · Actively exploited
CVE-2024-40891Zyxel DSL CPE OS Command Injection Vulnerability
6.0 · Background exploitation
CVE-2024-40890Zyxel DSL CPE OS Command Injection Vulnerability
5.9 · Background exploitation
CVE-2017-6884Zyxel EMG2926 Routers Command Injection Vulnerability
6.9 · Background exploitation
CVE-2017-18368Zyxel P660HN-T1A Routers Command Injection Vulnerability
9.2 · Background exploitation
CVE-2023-27992Zyxel Multiple NAS Devices Command Injection Vulnerability
8.8 · Background exploitation