Zyxel Firewall CVE-2024-11667: Helldown Ransomware Entry
The fix shipped in September 2024, but stolen firewall credentials outlive the patch: confirm ZLD 5.39 or later, then make sure every credential was rotated after the upgrade and no rogue VPN users remain.
Must act: Owners of Zyxel ATP, USG FLEX, USG FLEX 50(W) or USG20(W)-VPN firewalls in on-premises mode that ran ZLD 5.38 or older with remote management or SSL VPN enabled.
Can relax: Devices managed in Nebula cloud mode (Zyxel says they were not affected) and on-premises devices upgraded to 5.39+ whose admin, user and VPN credentials were changed afterward.
- Confirm every ATP, USG FLEX and USG20(W)-VPN runs ZLD 5.39 or later (Dashboard, or show version in the CLI).
- Change all admin and user passwords, VPN pre-shared keys and AD/RADIUS bind passwords, unless you already did so after upgrading.
- Delete unknown admin and user accounts and force-log out unrecognized sessions.