CVE-2024-11667: Zyxel Multiple Firewalls Path Traversal Vulnerability
A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series firmware versions V5.00 through V5.38, USG FLEX 50(W) series firmware versions V5.10 through V5.38, and USG20(W)-VPN series firmware versions V5.10 through V5.38 could allow an attacker to download or upload files via a crafted URL.
Published Nov 27, 2024 · Updated Aug 5, 2026
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Advisory details
From the National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series firmware versions V5.00 through V5.38, USG FLEX 50(W) series firmware versions V5.10 through V5.38, and USG20(W)-VPN series firmware versions V5.10 through V5.38 could allow an attacker to download or upload files via a crafted URL.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology
More Zyxel vulnerabilities
All Zyxel entriesCVE-2026-7273
Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability
high8.8ExploitedJun 16, 2026CVE-2024-40890
Zyxel DSL CPE OS Command Injection Vulnerability
high8.8ExploitedFeb 4, 2025CVE-2024-40891
Zyxel DSL CPE OS Command Injection Vulnerability
high8.8ExploitedFeb 4, 2025CVE-2023-27992
Zyxel Multiple NAS Devices Command Injection Vulnerability
critical9.8ExploitedJun 19, 2023CVE-2023-33009
Zyxel Multiple Firewalls Buffer Overflow Vulnerability
critical9.8ExploitedMay 24, 2023CVE-2023-33010
Zyxel Multiple Firewalls Buffer Overflow Vulnerability
critical9.8ExploitedMay 24, 2023