CVE-2023-33010
Zyxel Multiple Firewalls Buffer Overflow Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2023-06-05. Federal due date: 2023-06-26.
Apply updates per vendor instructions.
Impact
A buffer overflow vulnerability in the ID processing function in Zyxel ATP series firmware versions 4.32 through 5.36 Patch 1, USG FLEX series firmware versions 4.50 through 5.36 Patch 1, USG FLEX 50(W) firmware versions 4.25 through 5.36 Patch 1, USG20(W)-VPN firmware versions 4.25 through 5.36 Patch 1, VPN series firmware versions 4.30 through 5.36 Patch 1, ZyWALL/USG series firmware versions 4.25 through 4.73 Patch 1, could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and even a remote code execution on an affected device.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Zyxel | Atp100 Firmware | from 4.32 before 5.36 Version 5.36 |
| Zyxel | Atp200 Firmware | from 4.32 before 5.36 Version 5.36 |
| Zyxel | Atp500 Firmware | from 4.32 before 5.36 Version 5.36 |
| Zyxel | Atp100w Firmware | from 4.32 before 5.36 Version 5.36 |
| Zyxel | Atp700 Firmware | from 4.32 before 5.36 Version 5.36 |
| Zyxel | Atp800 Firmware | from 4.32 before 5.36 Version 5.36 |
| Zyxel | Usg Flex 100 Firmware | from 4.50 before 5.36 Version 5.36 |
| Zyxel | Usg Flex 50 Firmware | Version 5.36 |
| Zyxel | Usg Flex 200 Firmware | from 4.50 before 5.36 Version 5.36 |
| Zyxel | Usg Flex 500 Firmware | from 4.50 before 5.36 Version 5.36 |
| Zyxel | Usg Flex 700 Firmware | from 4.50 before 5.36 Version 5.36 |
| Zyxel | Usg Flex 100w Firmware | Version 5.36 |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-buffer-overflow-vulnerabilities-of-firewalls
- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-buffer-overflow-vulnerabilities-of-firewalls
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-33010