#vendor-disclosure

Analysis · May 10, 2026 · Colten Anderson

Zyxel patched CVE-2024-11667 in September. They named it in November

The fix shipped on September 3, 2024. The CVE assignment came eleven weeks later, after Helldown was already in production networks. The customers who patched on time still got compromised.