#vendor-disclosure

Analysis · May 10, 2026 · The Commentary Desk

Zyxel patched CVE-2024-11667 in September. They named it in November

The fix shipped on September 3, 2024. The CVE assignment came eleven weeks later, after Helldown was already in production networks. The customers who patched on time still got compromised.