ZyxelExploited incident
Zyxel ZLD firewall web management directory traversal used by Helldown ransomware
CVE-2024-11667High, CVSS 7.5In CISA's Known Exploited Vulnerabilities catalog since 3 Dec 2024
- Exploited after a fix existed
- Known ransomware use
Response
- Silence
- 0h First public report to first vendor statement
- Exposure
- same day First public report to first fix
- Follow-through
- same day First public report to a fix for every supported version
- Vendor silent
- Vendor statement, no fix
- Fixed for some versions
- Fixed when disclosed
- Date only, no time of day
Timeline and evidence
Open a moment to see its source and archived quote.
First public report
Zyxel Community (Zyxel employee post, Wayback capture 2024-11-03)CuratedQuote verified
Zyxel team has been tracking the recent activity of threat actors targeting Zyxel security appliances
Zyxel employee post 'Zyxel USG FLEX and ATP series – Upgrading your device and ALL credentials to avoid hackers' attack'. Time from the post's <time datetime='2024-10-09T02:59:28+00:00'> attribute; the capture (2024-11-03) shows 'October 9 edited October 22', so the October 9 wording is not verified. At the time Zyxel attributed the attacks to credentials stolen through earlier vulnerabilities rather than a new bug; the 2024-11-21 advisory, which names CVE-2024-11667, refers back to this outreach ('we have strongly urged users to update their firmware and change admin passwords'). Judgement call: recorded as a candidate, not proof that Zyxel knew of this CVE.
- Source
- Zyxel Community (Zyxel employee post, Wayback capture 2024-11-03) vendor blog
- Recorded time
- Precision
- To the minute
- Origin
- Curated. Found by a researcher, with a verbatim quote and link.
- Quote check
- Found in the archived copy
- Snapshot
sha256:492a124ae1f9459e…- Used in metrics
- Yes
5 more sources for this moment
Sekoia TDR blog: Helldown RansomwareCuratedQuote verified19 Nov 2024
Sekoia links initial access to the exploitation of a Zyxel firewall vulnerability, later tracked as CVE-2024-11667.
Post dated November 19, 2024 (the report went to Sekoia customers on 2024-11-14). The 'later tracked as' wording shows the page was updated after the CVE was assigned. Earlier public reporting on Helldown may exist (not found).
- Source
- Sekoia TDR blog: Helldown Ransomware research
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Curated. Found by a researcher, with a verbatim quote and link.
- Quote check
- Found in the archived copy
- Snapshot
sha256:1685a534bdd72657…- Used in metrics
- No, kept for the record
CVE.org record CVE-2024-11667ClaimedQuote verified27 Nov 2024, 09:39 UTC
A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series firmware versions V5.00 through V5.38, USG FLEX 50(W)
CVE record published.
- Source
- CVE.org record CVE-2024-11667 cve record
- Recorded time
- Precision
- To the minute
- Origin
- Claimed. The date the source gives.
- Quote check
- Found in the archived copy
- Snapshot
sha256:21a451d824d43bcb…- Used in metrics
- No, kept for the record
Bluesky postClaimedQuote not checked yet27 Nov 2024, 11:03 UTC
ID: CVE-2024-11667
Earliest third-party post we hold.
- Source
- Bluesky post social
- Recorded time
- Precision
- To the minute
- Origin
- Claimed. The date the source gives.
- Quote check
- Not checked yet
- Snapshot
- No archived snapshot
- Used in metrics
- No, kept for the record
Mastodon postClaimedQuote not checked yet28 Nov 2024, 05:25 UTC
CVE Alert: CVE-2024-11667 - https://www. redpacketsecurity.com/cve_aler t_cve-2024-11667/ # OSINT # ThreatIntel # CyberSecurity # cve_2024_11667
Earliest third-party post we hold.
- Source
- Mastodon post social
- Recorded time
- Precision
- To the minute
- Origin
- Claimed. The date the source gives.
- Quote check
- Not checked yet
- Snapshot
- No archived snapshot
- Used in metrics
- No, kept for the record
CISA KEV (CVE-2024-11667)ClaimedQuote verified3 Dec 2024
Zyxel Multiple Firewalls Path Traversal Vulnerability
Added to CISA's KEV catalog on 2024-12-03.
- Source
- CISA KEV (CVE-2024-11667) kev
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Claimed. The date the source gives.
- Quote check
- Found in the archived copy
- Snapshot
sha256:ef8fffede5c47200…- Used in metrics
- No, kept for the record
Vendor statement
at disclosure
Zyxel Community (Zyxel employee post, Wayback capture 2024-11-03)CuratedQuote verified
Zyxel team has been tracking the recent activity of threat actors targeting Zyxel security appliances
Same post as the world candidate; see its note.
- Source
- Zyxel Community (Zyxel employee post, Wayback capture 2024-11-03) vendor blog
- Recorded time
- Precision
- To the minute
- Origin
- Curated. Found by a researcher, with a verbatim quote and link.
- Quote check
- Found in the archived copy
- Snapshot
sha256:492a124ae1f9459e…- Used in metrics
- Yes
1 more source for this moment
Zyxel security advisory: protecting against recent firewall threatsCuratedQuote verified21 Nov 2024
2024-11-21: Initial release
The CVE record was only published on 2024-11-27T09:39Z, when Zyxel updated the advisory's CVE description.
- Source
- Zyxel security advisory: protecting against recent firewall threats vendor advisory
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Curated. Found by a researcher, with a verbatim quote and link.
- Quote check
- Found in the archived copy
- Snapshot
sha256:b61abc5943c678c1…- Used in metrics
- No, kept for the record
First workaround
at disclosure
Zyxel Community (Zyxel employee post, Wayback capture 2024-11-03)CuratedQuote verified
Fix Action: Change ALL your password, DO NOT re-use the same password
Same post; it also says 'Fix Action: Upgrade your device firmware to the LATEST release 5.39' and lists affected firmware 'ZLD V4.32 to ZLD 5.38'.
- Source
- Zyxel Community (Zyxel employee post, Wayback capture 2024-11-03) vendor blog
- Recorded time
- Precision
- To the minute
- Origin
- Curated. Found by a researcher, with a verbatim quote and link.
- Quote check
- Found in the archived copy
- Snapshot
sha256:492a124ae1f9459e…- Used in metrics
- Yes
1 more source for this moment
Zyxel security advisory: protecting against recent firewall threatsCuratedQuote verified21 Nov 2024
If updates cannot be applied immediately, temporarily disable remote access to your device until the firmware is patched.
- Source
- Zyxel security advisory: protecting against recent firewall threats vendor advisory
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Curated. Found by a researcher, with a verbatim quote and link.
- Quote check
- Found in the archived copy
- Snapshot
sha256:b61abc5943c678c1…- Used in metrics
- No, kept for the record
First fix
date onlysame day
Zyxel security advisory: protecting against recent firewall threatsCuratedQuote verified
We confirm that firewall firmware version 5.39, released on September 3, 2024, and later versions are immune to the mentioned exploitation, as we have addressed all known vulnerabilities, including CVE-2024-11667
Silent fix: ZLD 5.39 shipped 2024-09-03 without identifying this vulnerability.
- Source
- Zyxel security advisory: protecting against recent firewall threats vendor advisory
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Curated. Found by a researcher, with a verbatim quote and link.
- Quote check
- Found in the archived copy
- Snapshot
sha256:b61abc5943c678c1…- Used in metrics
- Yes
Fixed for all versions
date onlysame day
Zyxel security advisory: protecting against recent firewall threatsCuratedQuote verified
We confirm that firewall firmware version 5.39, released on September 3, 2024, and later versions are immune to the mentioned exploitation, as we have addressed all known vulnerabilities, including CVE-2024-11667
All affected series (ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN) run ZLD firmware and are fixed in 5.39.
- Source
- Zyxel security advisory: protecting against recent firewall threats vendor advisory
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Curated. Found by a researcher, with a verbatim quote and link.
- Quote check
- Found in the archived copy
- Snapshot
sha256:b61abc5943c678c1…- Used in metrics
- Yes
Send this to your boss
No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.
Affected products
- Zyxel ATP series
- Zyxel USG FLEX series
- Zyxel USG FLEX 50(W)
- Zyxel USG20(W)-VPN (ZLD firmware)
How we built this timeline
Fix-before-disclosure case: ZLD 5.39 (3 Sep 2024) fixed the bug; Zyxel only identified it as CVE-2024-11667 after Sekoia's Helldown report (customers 14 Nov 2024, public 19 Nov 2024). exploited before a fix is false under rule R4 (corrected from null on 23 Oct 2026): the fix (ZLD 5.39, 3 Sep 2024) was public before the earliest public evidence of exploitation (Zyxel's 9 Oct 2024 community post; the audit also cites forum user reports from late September 2024 via heise, not fetched here).
Helldown claimed victims from about August 2024, but no source ties those intrusions to this bug before 5.39 shipped. Advisory revision history: 21 Nov 2024 initial release; 27 Nov 2024 CVE description updated.
KEV 3 Dec 2024 (ransomware use Known). Zyxel CVSS 7.5.
Zyxel says it 'strongly urged users to update their firmware and change admin passwords' before the advisory; the date of that outreach was not evidenced. T2 search (23 Oct 2026) before keeping exploited before a fix=false: Sekoia's Helldown report (19 Nov 2024) says Helldown was first seen in August 2024 and suspected CVE-2024-42057 (IPSec VPN command injection, also fixed in 5.39) or an undocumented Zyxel flaw for initial access;
BleepingComputer, SecurityWeek and the German CERT coverage give no date for CVE-2024-11667 use before 3 Sep 2024. No source places exploitation of this CVE before the 5.39 fix, so the value stays false; if a later report shows Helldown used CVE-2024-11667 in August 2024, it becomes true.
Related
No related incidents.