CVE-2024-11667

Published: Nov 27, 2024Modified: Oct 27, 2025CISA KEV

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series firmware versions V5.00 through V5.38, USG FLEX 50(W) series firmware versions V5.10 through V5.38, and USG20(W)-VPN series firmware versions V5.10 through V5.38 could allow an attacker to download or upload files via a crafted URL.

Affected (2)

Products: Zyxel: Zld

Zyxel

1 product

Zld

Configuration A

7 platform

Running on/with	Platform Versions
Zyxel Atp	All versions
Zyxel Atp100	All versions
Zyxel Atp100w	All versions
Zyxel Atp200	All versions
Zyxel Atp500	All versions
Zyxel Atp700	All versions
Zyxel Atp800	All versions

Configuration B

1 vulnerable · 8 platform

Vulnerable Software	Affected Versions
Zyxel Zld	From 5.00 to 5.38

Running on/with	Platform Versions
Zyxel Usg Flex	All versions
Zyxel Usg Flex 100	All versions
Zyxel Usg Flex 100ax	All versions
Zyxel Usg Flex 100w	All versions
Zyxel Usg Flex 200	All versions
Zyxel Usg Flex 50	All versions
Zyxel Usg Flex 500	All versions
Zyxel Usg Flex 700	All versions