CVE-2024-42059: Zyxel ZLD RCE Vulnerability Explained

CVE-2024-42059 Overview

CVE-2024-42059 is a post-authentication command injection vulnerability [CWE-78] affecting Zyxel ATP, USG FLEX, USG FLEX 50(W), and USG20(W)-VPN firewall series running firmware versions V5.00 through V5.38. An authenticated attacker with administrator privileges can execute operating system commands on an affected device by uploading a crafted compressed language file through FTP. The flaw resides in how the firmware processes uploaded language file archives, allowing attacker-controlled input to reach OS command execution paths.

Critical Impact
An administrator-level attacker can achieve arbitrary OS command execution on Zyxel firewall appliances, compromising confidentiality, integrity, and availability of the perimeter device.

Affected Products

Zyxel ATP series firmware V5.00 through V5.38 (ATP100, ATP100W, ATP200, ATP500, ATP700, ATP800)
Zyxel USG FLEX series firmware V5.00 through V5.38 (USG FLEX 50, 50W, 100, 100AX, 100W, 200, 500, 700)
Zyxel USG20(W)-VPN series firmware V5.00 through V5.38

Discovery Timeline

2024-09-03 - Zyxel publishes security advisory for multiple firewall vulnerabilities
2024-09-03 - CVE-2024-42059 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-42059

Vulnerability Analysis

CVE-2024-42059 is a command injection flaw classified under [CWE-78] (Improper Neutralization of Special Elements used in an OS Command). The affected Zyxel firewall firmware exposes an administrative FTP interface that accepts compressed language file uploads. When the firmware processes the archive, filenames or embedded metadata within the compressed file are passed to an OS shell without proper sanitization.

An attacker who has already obtained administrator credentials can craft a compressed language file containing shell metacharacters. Upon upload and processing, the injected commands execute in the context of the firmware process, which typically runs with elevated privileges on the appliance.

Root Cause

The root cause is missing neutralization of shell metacharacters in filenames or archive entries within uploaded language file bundles. The firmware routine responsible for extracting and installing the language pack invokes system-level utilities without escaping or validating input, allowing metacharacters such as backticks, semicolons, or command substitution constructs to break out of the intended command context.

Attack Vector

Exploitation requires authenticated access with administrator privileges and network reachability to the appliance FTP service. The attacker authenticates to FTP, uploads a maliciously named or maliciously structured compressed language file, and triggers processing through the firmware's language file handling routine. Successful exploitation yields arbitrary command execution on the underlying operating system of the firewall.

Because exploitation requires valid administrator credentials, the primary risk scenarios involve credential theft, insider abuse, or chaining with a separate authentication bypass. Refer to the Zyxel Security Advisory for Firewalls for vendor technical details.

Detection Methods for CVE-2024-42059

Indicators of Compromise

Unexpected FTP connections to the firewall's management interface from unusual source addresses or at atypical hours.
Language file upload events in device logs immediately followed by unexpected process spawns or configuration changes.
Outbound network connections initiated by the appliance to unknown external hosts, suggesting post-exploitation callbacks.
Newly created accounts, altered firewall rules, or modified system files without corresponding change tickets.

Detection Strategies

Monitor administrative FTP sessions on Zyxel appliances and alert on language file uploads outside sanctioned change windows.
Ingest Zyxel syslog data into a central SIEM and correlate authentication events with file upload and system command activity.
Baseline normal administrator behavior and flag deviations such as off-hours logins or logins from previously unseen IP addresses.

Monitoring Recommendations

Forward firewall audit and system logs to a centralized log platform with alerting on admin account activity.
Track appliance firmware version inventory to identify devices running V5.00 through V5.38.
Monitor for outbound connections from the firewall's own management plane, which should rarely originate connections beyond updates and telemetry.

How to Mitigate CVE-2024-42059

Immediate Actions Required

Upgrade affected Zyxel ATP, USG FLEX, and USG20(W)-VPN devices to firmware versions released after V5.38 as directed by the vendor advisory.
Restrict access to the firewall's FTP and administrative management interfaces to trusted management networks only.
Rotate all administrator credentials and enforce multi-factor authentication where supported.
Audit administrator account activity for the period covering firmware versions V5.00 through V5.38.

Patch Information

Zyxel released firmware updates addressing CVE-2024-42059 on September 3, 2024. Administrators should apply the fixed firmware version specified in the Zyxel Security Advisory for Firewalls. Confirm the running firmware version through the device Web UI or CLI after upgrade.

Workarounds

Disable the FTP service on affected appliances if it is not required for operations.
Enforce network-layer access control lists that limit management-plane access to a small set of jump hosts.
Segment the firewall management interface onto a dedicated out-of-band management network.

bash

# Example ACL concept to restrict management access to a jump host
# Apply on upstream router or in Zyxel policy configuration
permit tcp host 10.10.10.5 any eq 21   # allow only jump host to FTP
permit tcp host 10.10.10.5 any eq 443  # allow only jump host to HTTPS admin
deny   tcp any any eq 21
deny   tcp any any eq 443