by Kastro
Paper/Archive/CVE-2024-11667

CVE-2024-11667

Zyxel ATP series firmware — Zyxel Multiple Firewalls Path Traversal Vulnerability

KEV · due 24 Decransomware useEPSS 3%public exploitSSVC actCVSS 9.8
critical.is priorityof 100
97
CVSS 9.8 (NVD)9.8 / 10 × 3029.4In CISA KEV+3030.0EPSS percentile 87.1.871 × 2017.4Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series firmware versions V5.00 through V5.38, USG FLEX 50(W) series firmware versions V5.10 through V5.38, and USG20(W)-VPN series firmware versions V5.10 through V5.38 could allow an attacker to download or upload files via a crafted URL.

Affected

ProductAffectedFixed inSource
ATP series firmwareversions V5.00 through V5.38–CNA
USG FLEX series firmwareversions V5.00 through V5.38–CNA
USG FLEX 50(W) series firmwareversions V5.10 through V5.38–CNA
USG20(W)-VPN series firmwareversions V5.10 through V5.38–CNA
usg_flex_firmware5.00 – 5.38–CISA-ADP
atp_firmware5.00 – 5.38–CISA-ADP
usg20-vpn_firmware5.10 – 5.38–CISA-ADP
usg_flex_50w_firmware5.10 – < 5.385.38CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Zyxel (CNA)7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: partial

References

advisoryzyxel.com/global/en/support/security-advisories/zyxel-security-advisory-protecting-against-recent-firewall-threats-11-27-2024refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-11667kevcisa.gov/known-exploited-vulnerabilities-catalog