CVE-2024-11667High· 7.5▾ Abyssal⚠ Exploited in the wildA directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series firmware versions V5.00 through V5.38, USG FLEX 50(W) series firmware versions V5.10 through V…
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 41.3 · likelihood 0.6 · exploitation 25 · ransomware 5
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Federal remediation due Dec 24, 2024
Last analysed / modified upstream
3.0%
Added to the CISA catalog on Dec 3, 2024. Federal remediation due Dec 24, 2024. View catalog ↗
A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series firmware versions V5.00 through V5.38, USG FLEX 50(W) series firmware versions V5.10 through V5.38, and USG20(W)-VPN series firmware versions V5.10 through V5.38 could allow an attacker to download or upload files via a crafted URL.
zld >= 5.00, <= 5.38zld >= 5.10, <= 5.38Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2021-21972Critical· 9.8The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin
CVE-2019-19781Critical· 9.8An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0
CVE-2021-40444High· 8.8Microsoft is investigating reports of a remote code execution vulnerability in MSHTML that affects Microsoft Windows
CVE-2023-41266High· 8.2A path traversal vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows an un…
CVE-2024-57727High· 7.5SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests
CVE-2024-55550Low· 2.7Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local file read, due to insufficient input sanitization