High‑Severity Path Traversal in Zyxel Firewalls (CVE‑2024‑11667) Threatens Management Interface
What It Is
A path‑traversal flaw exists in the web‑based management console of several Zyxel firewall models. By sending a crafted URL, an unauthenticated remote actor can read arbitrary files from the device’s filesystem or upload malicious files, potentially compromising the firewall’s configuration and the networks it protects.
Exploitability
- No public evidence of active exploitation, but a proof‑of‑concept request has been published.
- The vulnerability is rated High (CVSS ≈ 7.5) by CISA’s Known Exploited Vulnerabilities (KEV) catalog, indicating a realistic threat vector and a low barrier to abuse.
Affected Products
- Zyxel firewalls across multiple series (exact models listed in the vendor advisory).
Why It Matters for Compliance & Audit Readiness
Control‑assurance programs rely on demonstrable protection of critical security infrastructure. A compromised firewall undermines access‑control and configuration‑integrity controls, eroding the evidence base required for frameworks such as NIST CSF, ISO 27001, and PCI‑DSS. Prompt remediation and documented evidence of patching are essential to maintain a defensible audit trail and to satisfy vendor‑management controls that demand continuous monitoring of third‑party risk.
Recommended Actions
- Patch Immediately – Deploy Zyxel’s security update for the affected models.
- Validate Access Controls – Verify that the management interface is restricted to authorized IP ranges and uses multi‑factor authentication.
- Enable File‑Integrity Monitoring – Log and alert on any unexpected file reads or writes on the firewall’s filesystem.
- Update Asset Inventory – Ensure all Zyxel firewalls are listed in your CMDB with current firmware versions.
- Document Remediation – Capture patch deployment evidence and update your risk register to reflect the mitigated control.
Source: CISA KEV – CVE‑2024‑11667