Skip to content
Fencer Intel
high 8.1

CVE-2024-42057 json

A command injection vulnerability in the IPSec VPN feature of Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series…

published 2y ago modified 4mo ago also EUVD-2024-39425

cvss
8.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.3%
EPSS 1.3% chance of exploitation in 30 days, percentile 71%
public exploits
0
none known

Summary

A command injection vulnerability in the IPSec VPN feature of Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50 through V5.38, USG FLEX 50(W) series firmware versions from V4.16 through V5.38, and USG20(W)-VPN series firmware versions from V4.16 through V5.38 could allow an unauthenticated attacker to execute some OS commands on an affected device by sending a crafted username to the vulnerable device. Note that this attack could be successful only if the device was configured in User-Based-PSK authentication mode and a valid user with a long username exceeding 28 characters exists.

Patch / fix

  • zyxel zld 5.39

Is CVE-2024-42057 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Ransomware

Groups reported to have exploited it in intrusions.

  • Helldown ransomware gang

reported by blog.sekoia.io

Ransomware Vulnerability Matrix by BushidoUK (github.com/BushidoUK/Ransomware-Vulnerability-Matrix), reformatted per CVE. CC BY 4.0

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2y ago

Exploit prediction

1.32% chance of exploitation in the next 30 days, higher than 71% of all scored CVEs (FIRST EPSS, 2026-11-11).

CVSS scores

assigned by version score vector
CNA 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Zyxel ATP series firmware
  • Zyxel USG FLEX series firmware
  • Zyxel USG FLEX 50(W) series firmware
  • Zyxel USG20(W)-VPN series firmware
  • zyxel atp800_firmware
  • zyxel usg_flex_700h_firmware
  • zyxel usg_flex_50w_firmware

Classification

Weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.