CVE-2024-11667

A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware...

7.5 HighIn KEV

A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series firmware versions V5.00 through V5.38, USG FLEX 50(W) series firmware versions V5.10 through V5.38, and USG20(W)-VPN series firmware versions V5.10 through V5.38 could allow an attacker to download or upload files via a crafted URL.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

2.95%Up 2.9 points since Nov 28, 2024

What each source reports

CVE List Score used 7.5

Record: CVE-2024-11667
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-22
Updated: 2026-11-02

EUVDEUVD-2024-34151 7.5

Record: EUVD-2024-34151
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-h9fh-gm4r-6cxh 7.5

A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware...

Record: GHSA-h9fh-gm4r-6cxh
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-22
Updated: 2026-11-02

CISA KEV No score

Zyxel Multiple Firewalls Path Traversal Vulnerability

Multiple Zyxel firewalls contain a path traversal vulnerability in the web management interface that could allow an attacker to download or upload files via a crafted URL.

Record: CVE-2024-11667
Weakness: CWE-22
Updated: 2026-11-02

NVD 7.5

Record: CVE-2024-11667
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-22
Updated: 2026-11-02

Affected products

History

History
Recorded	Changed	Sources
Nov 3, 2026	exploitation
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, CISA KEV, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-11667 is a high vulnerability (CVSS 7.5) in Zyxel Atp Series Firmware, published November 27, 2024. CISA lists it as known to be exploited, since December 3, 2024. EUVD reports exploitation since December 3, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.95%, the 87th percentile. No source names a fixed version.