Vulnerability Analysis
CVE-2024-11667
A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series firmware versions V5.00 through V5.38, USG FLEX 50(W) series firmware versions V5.10 through V5.38, and USG20(W)-VPN series firmware versions V5.10 through V5.38 could allow an attacker to download or upload files via a crafted URL.
CISA KEV
SSVC: Active Exploitation
Automatable
Path Traversal
CVSS Base Score
7.5
HIGH
Exploitability:3.9
Impact Score:3.6
Temporal Score:-
EPSS:3.02%
Threat Intelligence Signals
CISA KEV
YES
KEV Date Added
2024-12-03
Ransomware Use
Known
KEV Due Date
2024-12-24
VulnCheck In-the-Wild
No
Nuclei Template
No
EPSS Score
3.017%
EPSS Percentile
86.1th pct
GHSA ID
GitHub Severity
HIGH
SSVC Exploitation
Active
SSVC Automatable
Yes
Vulnerability Class
Path Traversal
Identity & Timeline
| Status | - |
| Assigning Authority | - |
| CVSS Version / Source | - |
| Reserved | - |
| Published | - |
| Patch Date (date_public) | - |
| Exploit DB Date | - |
| First GitHub PoC Date | - |
| Last Updated | - |
| Time to Patch (Days to fix) | - |
| Exploit Release Gap | - |
| PoC Release Gap | - |
| Exploit DB References | None identified |
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| No affected products specified. | ||
Social Buzz