Zyxel Firewall CVE-2024-11667: Helldown Ransomware Entry

What to do

1. Confirm every ATP, USG FLEX and USG20(W)-VPN runs ZLD 5.39 or later (Dashboard, or show version in the CLI).
2. Change all admin and user passwords, VPN pre-shared keys and AD/RADIUS bind passwords, unless you already did so after upgrading.
3. Delete unknown admin and user accounts and force-log out unrecognized sessions.
4. Remove ANY-to-ANY, WAN-to-LAN and SSL VPN-to-device rules you did not create.
5. Turn off web management from the WAN, or restrict it to fixed source IPs with two-factor authentication.

How to check if you are affected or compromised

• Look for SSL VPN users named SUPPOR87, SUPPORT87, SUPPOR817, vpn or OKSDW82A, or any account you did not create.
• Search logs and SecuReporter for admin logins followed by creation and deletion of SSL VPN users, and logins from commercial VPN exits such as Mullvad.
• Check the device file manager for an unexpected zzz1.conf configuration file.
• On the LAN, hunt for Mimikatz, Advanced Port Scanner, disabled antivirus and new TeamViewer or RDP sessions originating from VPN address pools.

What happened#

CVE-2024-11667 is a directory traversal flaw in the web management interface of Zyxel's ZLD firewall firmware. A crafted URL lets an attacker download or upload files on the device. Zyxel rates it CVSS 3.1 7.5, scoring the impact as confidentiality only. Zyxel has not published exactly how the flaw was used in the attacks.

The bug surfaced through ransomware cases. In November 2024, Sekoia reported that at least eight victims of Helldown, a ransomware group active since August 2024, had Zyxel firewalls as their IPSec VPN entry points. It documented a rogue account, OKSDW82A, used for SSL VPN logins from a Mullvad VPN address, and an uploaded file, zzz1.conf. Zyxel published an advisory on November 21 and added the CVE on November 27. It says firmware 5.39, released September 3, 2024, and later versions are "immune to the mentioned exploitation." CISA added the CVE to KEV on December 3, 2024 and marks it as known to be used in ransomware campaigns. Germany's CERT told Cybersecurity Dive that Helldown had named about 32 victims.

Who is affected#

Per the CVE record: ATP and USG FLEX on ZLD 5.00 through 5.38, plus USG FLEX 50(W) and USG20(W)-VPN on 5.10 through 5.38. Zyxel's community guidance narrows the real-world risk to on-premises devices that had remote management or SSL VPN enabled, and says Nebula cloud-managed devices were not affected.

Do you really need to act?#

Patching alone was never enough. Zyxel EMEA's guidance describes attackers reusing credentials stolen through earlier vulnerabilities. They created temporary SSL VPN users, opened up firewall policies, then deleted the users. A firewall upgraded to 5.39 but still using the old admin password stays open to whoever already holds it. Zyxel EMEA's notice, quoted by SecurityWeek, tells users to "update all administrators and all user accounts." Two years on, the honest question is whether you rotated credentials after upgrading, not whether you upgraded.

What to do now#

1. Check the firmware on each device in the Dashboard, or with show version in the CLI. Anything below 5.39 needs upgrading. Note that Zyxel's community post covers ZLD 4.32 through 5.38 for the credential-theft activity.
2. Change all admin and user passwords, remote-access and site-to-site VPN pre-shared keys, and AD/RADIUS service passwords. Don't use admin-privileged accounts to bind to external servers.
3. Under Configuration > Object > User/Group, delete accounts you did not create, and force-log out unknown sessions.
4. Remove ANY-to-ANY, WAN-to-LAN and SSL VPN-to-device rules you did not add.
5. Disable WAN-side web management, or restrict it to fixed source IPs. Enable two-factor authentication for admins and SSL VPN, and keep the HTTPS admin port separate from the SSL VPN port.

How to tell if you were hit#

On the firewall, look for SSL VPN users named SUPPOR87, SUPPORT87, SUPPOR817 or vpn (from Zyxel), or OKSDW82A (from Sekoia). Check SecuReporter or syslog for admin logins followed by the creation and deletion of VPN users, and for logins from commercial VPN exits. Look for a zzz1.conf file. Inside the network, Helldown intrusions documented by Truesec and Sekoia involved domain controller access and Mimikatz. Responders also found Advanced Port Scanner, disabled endpoint protection, and TeamViewer or RDP lateral movement. If you find any of these, treat it as a ransomware incident, not a firewall cleanup.

Timeline#

• Sep 3, 2024 — Zyxel releases ZLD 5.39.
• Nov 19, 2024 — Sekoia publishes its Helldown analysis.
• Nov 21, 2024 — Zyxel advisory confirms attacks on pre-5.39 firewalls.
• Nov 27, 2024 — CVE-2024-11667 published.
• Dec 3, 2024 — CISA adds it to KEV (ransomware use: known); due Dec 24.

Vulnerability records

• CVE-2024-11667 · KEV 2024-12-03 · A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series firmware…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Zyxel — Security advisory: protecting against recent firewall threats (CVE-2024-11667) zyxel.com
2. Zyxel Community — USG FLEX and ATP series: upgrading your device and ALL credentials to avoid hackers' attack community.zyxel.com
3. CVE record — CVE-2024-11667 cve.org
4. NVD — CVE-2024-11667 nvd.nist.gov
5. CISA — Known Exploited Vulnerabilities: CVE-2024-11667 cisa.gov
6. Sekoia — Helldown Ransomware: an overview of this emerging threat sekoia.com

Coverage and analysis

1. BleepingComputer — Helldown ransomware exploits Zyxel VPN flaw to breach networks bleepingcomputer.com
2. SecurityWeek — Recent Zyxel firewall vulnerability exploited in ransomware attacks securityweek.com
3. Cybersecurity Dive — CISA, German authorities warn of Zyxel firewall exploitation cybersecuritydive.com