CVE-2024-42060: Zyxel ZLD RCE Vulnerability Explained

CVE-2024-42060 Overview

CVE-2024-42060 is a post-authentication OS command injection vulnerability [CWE-78] affecting multiple Zyxel firewall product lines running the ZLD firmware. An authenticated attacker with administrator privileges can execute operating system commands on the device by uploading a crafted internal user agreement file. The flaw impacts the Zyxel ATP series (V4.32 through V5.38), USG FLEX series (V4.50 through V5.38), USG FLEX 50(W) series (V4.16 through V5.38), and USG20(W)-VPN series (V4.16 through V5.38). Zyxel published a coordinated advisory on September 3, 2024, addressing this issue alongside other firewall vulnerabilities.

Critical Impact
Administrator-level attackers can achieve arbitrary OS command execution on affected firewalls, undermining the confidentiality, integrity, and availability of the perimeter security appliance.

Affected Products

Zyxel ATP series firmware versions V4.32 through V5.38 (ATP100, ATP100W, ATP200, ATP500, ATP700, ATP800)
Zyxel USG FLEX series firmware versions V4.50 through V5.38 (USG FLEX 100, 100AX, 100W, 200, 500, 700) and USG FLEX 50(W) firmware V4.16 through V5.38
Zyxel USG20(W)-VPN series firmware versions V4.16 through V5.38

Discovery Timeline

2024-09-03 - Zyxel releases security advisory covering multiple firewall vulnerabilities
2024-09-03 - CVE-2024-42060 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-42060

Vulnerability Analysis

CVE-2024-42060 is a command injection weakness in the file-upload handler that processes the internal user agreement file on Zyxel ZLD-based firewalls. The management-plane component that consumes the uploaded file passes attacker-controlled content into an OS command context without adequate sanitization. Successful exploitation yields command execution in the security context of the process handling the upload, typically a privileged system service on the firewall. Because the affected devices sit at the network perimeter, execution on the appliance can be used to pivot into protected segments, disable inspection, or alter routing.

Root Cause

The root cause is improper neutralization of special elements used in an OS command [CWE-78]. The firmware routine that ingests the internal user agreement file constructs a shell command string using untrusted content from the upload, allowing metacharacters to break out of the intended argument and introduce additional commands.

Attack Vector

Exploitation requires an authenticated session with administrator privileges on the device management interface. The attacker uploads a crafted internal user agreement file, which triggers command execution when the firmware processes the file. No user interaction beyond the attacker's own authenticated actions is required. Because administrator credentials are a prerequisite, this issue chains most impactfully with credential theft, phishing against firewall operators, or exposure of the management interface to untrusted networks.

No public proof-of-concept exploit is listed in Exploit-DB, and the vulnerability is not present on the CISA Known Exploited Vulnerabilities catalog at the time of publication. Refer to the Zyxel Security Advisory for Firewalls for vendor technical details.

Detection Methods for CVE-2024-42060

Indicators of Compromise

Unexpected uploads of internal user agreement files through the firewall administrative interface, especially from unfamiliar administrator accounts or source IP addresses
New or modified files, scheduled tasks, or processes on the firewall following an administrative session that included a file upload
Outbound connections initiated by the firewall itself to attacker-controlled infrastructure shortly after administrative login events

Detection Strategies

Audit firewall administrator activity for file-upload events targeting the user agreement configuration, correlating uploads with subsequent process or configuration changes
Alert on administrator logins from geolocations, source networks, or times of day that deviate from established baselines for firewall operators
Compare running configuration and firmware integrity against known-good baselines to identify unauthorized modifications introduced through command execution

Monitoring Recommendations

Forward Zyxel firewall system and audit logs to a centralized log management or SIEM platform and retain them for post-incident analysis
Monitor management-plane access with strict allowlists and alert on any administrative session originating from outside approved administrative networks
Track firmware version inventory across all ATP, USG FLEX, and USG20(W)-VPN devices to identify appliances still running vulnerable ZLD releases

How to Mitigate CVE-2024-42060

Immediate Actions Required

Upgrade affected ATP, USG FLEX, USG FLEX 50(W), and USG20(W)-VPN devices to the fixed ZLD firmware release identified in the Zyxel advisory
Restrict administrative access to the firewall management interface to trusted management networks and jump hosts; never expose it to the internet
Rotate administrator credentials and enforce multi-factor authentication for all firewall administrator accounts

Patch Information

Zyxel released firmware updates addressing CVE-2024-42060 as part of the September 3, 2024 security advisory. Consult the Zyxel Security Advisory for Firewalls for the specific fixed ZLD version applicable to each product line and follow Zyxel's documented firmware upgrade procedure.

Workarounds

Limit the number of accounts that hold administrator privileges and review administrator role assignments against current operational need
Disable or firewall off remote management (HTTPS, SSH) on WAN interfaces and require VPN access before reaching the management plane
Enable two-factor authentication on all administrator accounts to reduce the risk of credential-based prerequisites being met

bash

# Configuration example: restrict WAN-side management access on Zyxel ZLD
# (Apply through the firewall CLI or web console; validate against your policy before use)
configure terminal
service-control HTTPS zone WAN deny
service-control SSH   zone WAN deny
exit
write