Riskcovery

CVE-2024-11667

State
Published
Severity
7.5 High
Published
Nov 27, 2024
Updated
Aug 5, 2026
Reserved
Nov 25, 2024

Read the record on cve.org

Description

A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series firmware versions V5.00 through V5.38, USG FLEX 50(W) series firmware versions V5.10 through V5.38, and USG20(W)-VPN series firmware versions V5.10 through V5.38 could allow an attacker to download or upload files via a crafted URL.

Scores

CVSSScoreVectorSource
3.17.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NZyxel

Weaknesses

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected Products

ProductVersions
ATP series firmwareZyxel
  • versions V5.00 through V5.38Affected
USG FLEX series firmwareZyxel
  • versions V5.00 through V5.38Affected
USG FLEX 50(W) series firmwareZyxel
  • versions V5.10 through V5.38Affected
USG20(W)-VPN series firmwareZyxel
  • versions V5.10 through V5.38Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.