CVE-2024-11667

What it actually does

CVE-2024-11667 is a directory traversal vulnerability in the web management interface of multiple Zyxel firewall and VPN appliance firmware lines. A remote attacker can send a crafted URL containing path traversal sequences to escape the intended web directory and read or write files on the appliance. Because the affected interface runs on security boundary devices and the CVSS score is 9.8, successful exploitation can enable unauthorized file download, file upload, configuration disclosure, credential or key exposure, persistence through dropped files, and potential follow-on compromise of the firewall or connected networks.

Why it matters to the business

Exploitation can turn an internet-facing firewall or VPN appliance into an entry point for data theft, operational disruption, ransomware staging, and lateral movement. This vulnerability is listed in CISA KEV, has confirmed in-the-wild exploitation, is associated with ransomware activity, and had a CISA remediation deadline of 2024-12-24, so unremediated systems should be treated as high-priority exposure even if no compromise is immediately visible.

How an attack unfolds

An attacker first identifies an exposed Zyxel web management interface running an affected firmware version. They then send HTTP or HTTPS requests with encoded or unencoded directory traversal sequences in the URL to access files outside the intended web root. For download abuse, the attacker may attempt to retrieve configuration files, account data, logs, keys, or other sensitive appliance files. For upload abuse, the attacker may place files in writable locations to support persistence, tooling, web-accessible payloads, or later command execution chains. After obtaining credentials or configuration details, the attacker can attempt authenticated access to the appliance, modify security policy, create backdoor accounts, pivot into protected networks, or support ransomware deployment. Because exploitation is known in the wild and the KEV entry indicates ransomware relevance, suspicious access should be investigated as a potential initial-access event rather than a simple web probing incident.

How to fix it

Upgrade affected Zyxel firmware to a vendor-fixed release or later for every exposed appliance. The affected ranges are Zyxel ATP series firmware V5.00 through V5.38, USG FLEX series firmware V5.00 through V5.38, USG FLEX 50(W) series firmware V5.10 through V5.38, and USG20(W)-VPN series firmware V5.10 through V5.38. If an immediate upgrade is not possible, remove internet exposure of the web management interface, restrict management access to trusted administrative networks or VPN-only access, disable unused remote administration features, enforce strong administrator authentication, review local accounts and configuration, and monitor for traversal attempts. Because this vulnerability is in CISA KEV and associated with ransomware campaigns, mitigation alone should be temporary; firmware remediation and compromise assessment are strongly recommended.

How to confirm the fix worked

Confirm the appliance model and firmware version from the Zyxel administrative interface, CLI, or asset inventory, and verify it is no longer within the affected version ranges. Validate that the web management interface is not reachable from untrusted networks unless explicitly required and protected by access controls. Review firewall exposure using external scanning, management-plane ACL checks, and configuration review. After upgrade, confirm the vendor firmware build installed successfully, reboot requirements were completed, configuration persisted as expected, and no unauthorized administrator accounts, modified policies, suspicious scheduled tasks, or unexpected files remain. If safe testing is authorized, use a non-destructive traversal check against a benign path and verify the appliance rejects traversal attempts rather than returning arbitrary file contents or accepting out-of-directory file writes.

Typical attack path

1. Scan the internet or target ranges for exposed Zyxel ATP, USG FLEX, USG FLEX 50(W), or USG20(W)-VPN web management interfaces.
2. Fingerprint the device family and firmware behavior from HTTP responses, TLS certificates, login pages, headers, or management interface paths.
3. Send crafted URLs containing directory traversal sequences such as ../ or encoded equivalents to escape the web management directory.
4. Download sensitive files such as configuration, logs, user/account data, certificates, keys, or system files.
5. Optionally upload files to writable paths to stage tools, persistence artifacts, or payloads for additional exploitation.
6. Use recovered credentials, configuration secrets, VPN information, or appliance access to modify settings, maintain access, or move deeper into the network.
7. Leverage the compromised security appliance as a foothold for reconnaissance, data theft, disruption, or ransomware operations.

How to detect it

Review HTTP/HTTPS access logs, reverse proxy logs, firewall logs, VPN appliance logs, Zyxel system logs, administrative audit logs, configuration change history, and SIEM telemetry for requests to the management interface containing path traversal sequences. Focus on requests with ../, encoded traversal patterns, attempts to read sensitive Unix-style paths, or unusual upload behavior. Correlate suspicious requests with successful HTTP status codes, abnormal response sizes, new or modified files, new administrator accounts, changed firewall/VPN rules, changed remote management settings, certificate/key export activity, unexpected reboots, and log gaps. Investigate source IPs that repeatedly probe Zyxel management paths or switch from unauthenticated traversal attempts to authenticated administrative activity. Because the vulnerability is KEV-listed and ransomware-associated, also look for post-exploitation behavior such as credential reuse, anomalous VPN logins, policy changes that weaken access controls, connections from the appliance to unusual external hosts, and signs of staging or lateral movement after the first suspicious management request.

• ../
• ..\\
• %2e%2e%2f
• %2e%2e/
• ..%2f
• %252e%252e%252f
• %2e%2e%5c
• ..%5c
• /etc/passwd
• /etc/shadow
• /etc/hosts
• /proc/self/environ
• /proc/version
• /var/log/
• /tmp/
• /var/tmp/
• /etc/zyxel/
• /conf/
• /config/
• /firmware/
• GET *../* HTTP
• POST *../* HTTP
• GET *%2e%2e%2f* HTTP
• POST *%2e%2e%2f* HTTP
• GET *..%2f* HTTP
• POST *..%2f* HTTP
• GET *%252e%252e%252f* HTTP
• POST *%252e%252e%252f* HTTP
• GET */etc/passwd* HTTP
• GET */etc/shadow* HTTP
• GET */proc/self/environ* HTTP

What your security team should do

• Immediately identify all Zyxel ATP, USG FLEX, USG FLEX 50(W), and USG20(W)-VPN appliances and determine whether firmware is in an affected range.
• Prioritize remediation for any internet-facing management interfaces, especially because the issue is in CISA KEV, has active exploitation, and is associated with ransomware activity.
• Upgrade affected firmware to the vendor-fixed release or later; where exact fixed builds are not centrally available, use the latest vendor-supported firmware for the applicable model line.
• Restrict web management access to trusted administrative sources only and disable public exposure of management interfaces.
• Perform a compromise assessment on affected appliances before or immediately after patching, including review of logs, configuration changes, administrator accounts, VPN settings, certificates, and recently modified files.
• Rotate credentials and secrets that may have been stored on or accessible from the appliance, including administrator passwords, VPN credentials, API keys, and certificates if compromise is suspected.
• Add SIEM detections for directory traversal strings and abnormal file access attempts against Zyxel management interfaces.
• Block or alert on repeated requests containing encoded traversal patterns targeting firewall management IPs.
• Preserve appliance logs and configuration backups before reimaging or factory reset if exploitation is suspected.
• If indicators of compromise are found, treat the device as a potential initial-access foothold and expand investigation to adjacent authentication systems, VPN usage, endpoint activity, and ransomware staging behavior.