CVE-2024-42059 Overview
CVE-2024-42059 is a post-authentication OS command injection vulnerability [CWE-78] affecting Zyxel ATP, USG FLEX, USG FLEX 50(W), and USG20(W)-VPN series firewalls running firmware versions V5.00 through V5.38. An authenticated attacker with administrator privileges can execute operating system commands on an affected device by uploading a crafted compressed language file via File Transfer Protocol (FTP). The flaw enables full compromise of the underlying firewall operating system.
Critical Impact
Successful exploitation grants OS-level command execution on perimeter firewall appliances, allowing attackers to pivot into protected networks, tamper with traffic policies, or establish persistence on network security infrastructure.
Affected Products
- Zyxel ATP series firmware V5.00 through V5.38 (ATP100, ATP100W, ATP200, ATP500, ATP700, ATP800)
- Zyxel USG FLEX series firmware V5.00 through V5.38 (USG FLEX 50, 50W, 100, 100AX, 100W, 200, 500, 700)
- Zyxel USG20(W)-VPN series firmware V5.00 through V5.38
Discovery Timeline
- 2024-09-03 - Zyxel publishes security advisory for multiple firewall vulnerabilities
- 2024-09-03 - CVE-2024-42059 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-42059
Vulnerability Analysis
The vulnerability is a command injection flaw classified under [CWE-78]: Improper Neutralization of Special Elements used in an OS Command. It resides in the code path that processes language pack uploads on the affected Zyxel Zero Loss Delivery (ZLD) firmware. An administrator can upload a compressed language file over FTP, and unsanitized content within that archive is passed to a shell context during processing.
Because exploitation requires authenticated administrator privileges, the flaw is most relevant in scenarios involving credential theft, insider abuse, or reuse of exposed administrator credentials. Once triggered, the attacker gains command execution in the context of the firewall service, which typically runs with elevated privileges on the appliance.
The impact chain is meaningful: firewalls sit at the network boundary and mediate segmentation, VPN termination, and inspection. OS-level control over the appliance undermines the trust boundary the device is designed to enforce.
Root Cause
The root cause is missing neutralization of shell metacharacters in filenames or metadata contained within the compressed language file. When the firmware extracts and processes the archive, attacker-controlled strings are concatenated into a command invocation without sanitization or safe argument passing.
Attack Vector
The attack requires authenticated access with administrator privileges and network reachability to the FTP service on the appliance. An attacker crafts a compressed language file containing malicious shell payloads, authenticates to FTP, uploads the archive, and triggers processing to achieve command execution. See the Zyxel Security Advisory for Firewalls for vendor-confirmed technical scope.
No public proof-of-concept exploit code is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2024-42059
Indicators of Compromise
- Unexpected FTP sessions to the firewall management interface from non-administrative source addresses or outside change windows.
- Uploads of .tar, .gz, or other compressed language pack files not correlated with a planned firmware or localization update.
- Unusual child processes or shell invocations originating from firmware update or language-processing daemons on the appliance.
- Outbound connections from the firewall itself to unfamiliar external hosts following an administrator FTP session.
Detection Strategies
- Monitor Zyxel device logs for FTP authentication events combined with subsequent language-file upload activity.
- Alert on any administrative session originating from IP addresses outside approved management networks.
- Correlate configuration or system-file changes on the appliance with the identity of the account that authenticated over FTP.
Monitoring Recommendations
- Forward firewall syslog and audit records to a centralized SIEM for long-term retention and correlation.
- Track administrator credential usage across all Zyxel appliances to detect credential reuse or lateral abuse.
- Baseline normal firmware and language pack update cadence, and treat off-schedule uploads as high-priority alerts.
How to Mitigate CVE-2024-42059
Immediate Actions Required
- Upgrade affected ATP, USG FLEX, and USG20(W)-VPN devices to firmware releases above V5.38 as directed in the Zyxel advisory.
- Restrict FTP and management access on the firewall to a dedicated, isolated administrative network segment.
- Rotate administrator credentials on all affected appliances and enforce multi-factor authentication where supported.
- Review recent administrator activity and language-file uploads for signs of prior exploitation.
Patch Information
Zyxel released fixed firmware addressing CVE-2024-42059 alongside other firewall vulnerabilities on September 3, 2024. Refer to the Zyxel Security Advisory for Firewalls for exact fixed firmware versions per model.
Workarounds
- Disable the FTP service on the firewall when it is not required for operational language pack or firmware workflows.
- Enforce strict access control lists limiting management-plane services to trusted jump hosts only.
- Require administrator authentication through a bastion host that logs all uploaded files for out-of-band inspection.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
