CVE-2024-11667Zyxel Multiple Firewalls Path Traversal Vulnerability
Aktif olarak istismar ediliyor — Zyxel Multiple Firewalls Path Traversal Vulnerability
CISA bu açığın gerçek saldırılarda kullanıldığını 03.12.2024 tarihinde doğruladı. ABD federal kurumları için düzeltme son tarihi: 24.12.2024.
Gerekli işlem: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-protecting-against-recent-firewall-threats-11-21-2024 ; https://nvd.nist.gov/vuln/detail/CVE-2024-11667
Açıklama
A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series firmware versions V5.00 through V5.38, USG FLEX 50(W) series firmware versions V5.10 through V5.38, and USG20(W)-VPN series firmware versions V5.10 through V5.38 could allow an attacker to download or upload files via a crafted URL.
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| zyxel | atp_firmware | 5.00 – ≤ 5.38 | |
| Zyxel | ATP series firmware | versions V5.00 through V5.38 | |
| zyxel | atp100 firmware | — | |
| zyxel | atp100w firmware | — | |
| zyxel | atp500 firmware | — | |
| zyxel | atp700 firmware | — | |
| zyxel | atp800 firmware | — | |
| zyxel | usg flex 100h firmware | — | |
| zyxel | usg flex 100hp firmware | — | |
| zyxel | usg flex 100w firmware | — | |
| zyxel | usg flex 200 firmware | — | |
| zyxel | usg flex 200h firmware | — | |
| zyxel | usg flex 200hp firmware | — | |
| zyxel | usg flex 50 firmware | — | |
| Zyxel | USG FLEX 50(W) series firmware | versions V5.10 through V5.38 | |
| zyxel | usg flex 500 firmware | — | |
| zyxel | usg flex 500h firmware | — | |
| zyxel | usg flex 500w firmware | — | |
| zyxel | usg flex 50ax firmware | — | |
| zyxel | usg_flex_50w_firmware | 5.10 – < 5.38 | |
| zyxel | usg flex 60ax firmware | — | |
| zyxel | usg flex 700 firmware | — | |
| zyxel | usg flex 700h firmware | — | |
| zyxel | usg_flex_firmware | 5.00 – ≤ 5.38 | |
| Zyxel | USG FLEX series firmware | versions V5.00 through V5.38 | |
| zyxel | usg20-vpn_firmware | 5.10 – ≤ 5.38 | |
| Zyxel | USG20(W)-VPN series firmware | versions V5.10 through V5.38 | |
| zyxel | zld | 5.00 – ≤ 5.38 |
Kaynaklar ve yamalar
- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-protecting-against-recent… vendor-advisoryVendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-11667 US Government Resource
CPE eşleşmeleri (NVD) (4)
cpe:2.3:o:zyxel:zld:*:*:*:*:*:*:*:*≥ 5.00 ≤ 5.38cpe:2.3:o:zyxel:zld:*:*:*:*:*:*:*:*≥ 5.00 ≤ 5.38cpe:2.3:o:zyxel:zld:*:*:*:*:*:*:*:*≥ 5.10 ≤ 5.38cpe:2.3:o:zyxel:zld:*:*:*:*:*:*:*:*≥ 5.10 ≤ 5.38