Exploitation observed; activity peaked at 3 mentions and remains active
Recommended action window: Immediate (within 24h)
NVD description
A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series firmware versions V5.00 through V5.38, USG FLEX 50(W) series firmware versions V5.10 through V5.38, and USG20(W)-VPN series firmware versions V5.10 through V5.38 could allow an attacker to download or upload files via a crafted URL.
Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2024-12-24. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Priority
HIGH
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 18 products
| Date | Total | Labels |
|---|
| 2026-05-02 | 3 | Active Exploitation3 |
| 2026-05-14 | 1 | Disclosure1 |
What happened CISA added CVE-2024-11667 to the Known Exploited Vulnerabilities (KEV) catalog on 2024-12-03, signaling in-the-wild exploitation (CISA KEV entry) (CISA). The entry describes a path traversal in the Zyxel firewall web management interface that enables file…
Post summary
CISA reports that CVE‑2024‑11667, a path‑traversal flaw in the Zyxel firewall web interface, is already being exploited in the wild.
CVE-2024-11667: CISA adds CVE-2024-11667 to KEV: Zyxel firewall web UI path traversal allows file download/upload via crafted URLs; ransomware use flagged.
Post summary
CISA lists CVE-2024-11667 as a KEV due to ransomware exploitation, with a path traversal flaw that lets attackers download or upload files via crafted URLs; no PoC or patch details are provided.
Zyxel fixed CVE-2024-11667 before customers knew what to look for. That is the disclosure failure operators hate most: the patch exists, the exploitation exists, and the signal arrives late. https://patchdayalert.com/blog/zyxel-cve-2024-11667-silent-patch/
Post summary
Zyxel issued a patch for CVE‑2024‑11667 before customers were alerted, illustrating a disclosure failure where the exploitation existed but the warning arrived too late.
https://research.lyrie.ai/research/active-exploit-cve-2024-11667-multiple-firewalls #lyrie #cybersecurity #CVE #threatintel #zerodayattack
Post summary
The linked research indicates that CVE‑2024‑11667 is actively exploited against multiple firewalls, yet it provides no patch, exploit code details, or in‑depth technical analysis.
18 of 18 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| HW | zyxel | atp | - | - | - |
| HW | zyxel | atp100 | - | - | - |
| HW | zyxel | atp100w | - | - | - |
| HW | zyxel | atp200 | - | - | - |
| HW | zyxel | atp500 | - | - | - |
| HW | zyxel | atp700 | - | - | - |
| HW | zyxel | atp800 | - | - | - |
| HW | zyxel | usg_20w-vpn | - | - | - |
| HW | zyxel | usg_flex | - | - | - |
| HW | zyxel | usg_flex_100 | - | - | - |
| HW | zyxel | usg_flex_100ax | - | - | - |
| HW | zyxel | usg_flex_100w | - | - | - |
| HW | zyxel | usg_flex_200 | - | - | - |
| HW | zyxel | usg_flex_50 | - | - | - |
| HW | zyxel | usg_flex_500 | - | - | - |
| HW | zyxel | usg_flex_50w | - | - | - |
| HW | zyxel | usg_flex_700 | - | - | - |
| OS | zyxel | zld | - | - | - |