CVE-2024-11667
Zyxel Multiple Firewalls Path Traversal Vulnerability
Description
CVE-2024-11667 is a high-severity directory traversal vulnerability in the web management interface of multiple Zyxel firewall product lines, including the ATP series, USG FLEX series, USG FLEX 50(W) series, and USG20(W)-VPN series running firmware versions V5.00 through V5.38. The flaw allows a remote, unauthenticated attacker to download or upload arbitrary files on the firewall via crafted URLs that traverse outside restricted directories. With a CVSS v3.1 base score of 7.5, the vulnerability enables unauthorized access to sensitive configuration data and credentials stored on the firewall. CISA has added CVE-2024-11667 to the Known Exploited Vulnerabilities catalog with a remediation deadline of December 24, 2024, and its EPSS score of 34.19% at the 96.9th percentile indicates a very high probability of exploitation. This vulnerability is associated with known ransomware campaigns.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| zyxel | zld | >= 5.00, <= 5.38; >= 5.10, <= 5.38 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
Weakness Type
CWE-22: Path Traversal
CVE-2024-11667 is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as path traversal or directory traversal. This weakness occurs when an application uses user-supplied input to construct file paths without properly neutralizing special elements such as "../" sequences that can resolve to locations outside the intended directory. In Zyxel's web management interface, the URL handling logic fails to adequately validate path components in HTTP requests, allowing attackers to craft URLs that reference files anywhere on the firewall's filesystem. This enables both downloading sensitive files (such as configuration backups and credential stores) and uploading malicious files to arbitrary locations on the device.
Impact Analysis
The impact of CVE-2024-11667 centers on confidentiality, which is rated as high. The directory traversal allows unauthenticated attackers to download configuration files, VPN credentials, SSL certificates, firewall rule sets, and user account information stored on the device. For organizations relying on Zyxel firewalls as their primary network security perimeter, this data exposure can provide attackers with everything needed to bypass the firewall entirely or establish unauthorized VPN connections into the protected network.
Integrity and availability are not directly impacted according to the CVSS vector (I:N/A:N), but the file upload capability introduces secondary risks. Attackers may be able to upload modified configuration files or malicious firmware that could alter firewall behavior. In practice, the information gained through file download — particularly VPN credentials and configuration data — has been leveraged to gain deeper network access, ultimately enabling ransomware deployment.
The attack requires no authentication (PR:N), no user interaction (UI:N), and has low complexity (AC:L), making automated scanning and exploitation straightforward. The EPSS score of 34.19% at the 96.9th percentile and confirmed association with known ransomware campaigns underscore the real-world severity beyond what the CVSS score alone suggests. Zyxel firewalls are widely deployed in small and medium-sized businesses that may lack dedicated security teams to detect and respond to exploitation quickly.
Exploit Maturity
CVE-2024-11667 demonstrates high exploit maturity, confirmed by CISA's inclusion in the Known Exploited Vulnerabilities catalog and its explicit association with known ransomware campaigns. The EPSS score of 34.19% at the 96.9th percentile places it among the top 3% of all vulnerabilities by exploitation probability.
The Zyxel security advisory provides the official vendor disclosure. Zyxel firewalls have been targeted by ransomware operators who exploit the directory traversal to extract VPN credentials and configuration data, then use this information to establish unauthorized access to internal networks. Once inside the network, the attackers deploy ransomware payloads. The simplicity of the exploitation technique — requiring only crafted HTTP requests to the web management interface — combined with the high value of the exposed data makes this vulnerability particularly attractive to financially motivated threat actors. Internet-exposed Zyxel management interfaces are routinely discovered through services like Shodan, enabling mass scanning campaigns.
Remediation
-
Update firmware immediately on all affected Zyxel firewall products to a version beyond V5.38. The Zyxel security advisory provides specific firmware versions and download links for each product line (ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN).
-
Restrict web management interface access immediately as a compensating control. Disable remote management access over the internet and limit the web interface to trusted internal management networks or specific administrator IP addresses. If remote management is required, use a VPN connection to access it rather than exposing it directly.
-
Rotate all credentials stored on or managed by the firewall after updating. This includes local administrator accounts, VPN user credentials, RADIUS shared secrets, LDAP bind credentials, SSL/TLS certificates and private keys, and any API keys configured on the device. Assume that all stored credentials have been compromised.
-
Review firewall and VPN logs for indicators of compromise, including unusual file access patterns in web server logs, unauthorized VPN connections, configuration changes not performed by administrators, and connections from unexpected geographic locations.
-
Implement network monitoring to detect any unauthorized access that may have been established through stolen VPN credentials. Monitor for lateral movement, unusual data transfers, and connections to known command-and-control infrastructure originating from internal systems.
Technical Details
CVE-2024-11667 is a directory traversal vulnerability in the web management interface of Zyxel firewall products. The CVSS v3.1 vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating a network-accessible attack with no prerequisites that results in high confidentiality impact.
The vulnerability exists in the HTTP request handling logic of the Zyxel web management interface. When processing URL requests, the application fails to properly sanitize path traversal sequences such as "../" in the URL path. An attacker can craft HTTP requests containing these sequences to escape the web root directory and access arbitrary files on the firewall's filesystem. The attack is entirely unauthenticated, requiring only network access to the management interface.
The practical exploitation typically targets files containing sensitive configuration data. Zyxel firewalls store configuration backups, VPN user databases, certificate files, and credential stores in known filesystem locations. By traversing to these locations, attackers can download complete firewall configurations including all VPN user credentials, network topology information, and security rule sets.
The file upload aspect of the vulnerability allows attackers to write files to arbitrary locations, potentially enabling configuration manipulation or persistence establishment. While the CVSS vector rates integrity impact as none, the upload capability represents a significant secondary risk vector.
Affected firmware versions span V5.00 through V5.38 for ATP and USG FLEX series, and V5.10 through V5.38 for USG FLEX 50(W) and USG20(W)-VPN series. The breadth of affected products and firmware versions means a large installed base of Zyxel firewalls is potentially vulnerable.
Frequently Asked Questions
What is CVE-2024-11667?
CVE-2024-11667 is a directory traversal vulnerability in the web management interface of Zyxel ATP, USG FLEX, USG FLEX 50(W), and USG20(W)-VPN firewalls. It allows unauthenticated remote attackers to download or upload files via crafted URLs that traverse outside restricted directories.
Is CVE-2024-11667 associated with ransomware?
Yes. CISA has confirmed that CVE-2024-11667 is associated with known ransomware campaigns. Threat actors exploit the vulnerability to extract VPN credentials and configuration data, then use this access to deploy ransomware within targeted networks.
Which Zyxel products and firmware versions are affected?
The ATP series and USG FLEX series running firmware V5.00 through V5.38 are affected, as well as the USG FLEX 50(W) and USG20(W)-VPN series running firmware V5.10 through V5.38. All products should be updated to firmware versions beyond V5.38.
Can this vulnerability be exploited if the management interface is not exposed to the internet?
The risk is significantly reduced but not eliminated. If the management interface is only accessible from the internal network, an attacker would need to already have internal network access. However, best practice is to patch regardless, as insider threats and compromised internal devices could still exploit the vulnerability.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.