medium6.5
CVE-2023-6397
A null pointer dereference vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1 and USG FLEX series firmware versions from 4.50 t…
Impact
A null pointer dereference vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1 and USG FLEX series firmware versions from 4.50 through 5.37 Patch 1 could allow a LAN-based attacker to cause denial-of-service (DoS) conditions by downloading a crafted RAR compressed file onto a LAN-side host if the firewall has the “Anti-Malware” feature enabled.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Zyxel | Atp100 Firmware | from 4.32 before 5.37 Version 5.37 |
| Zyxel | Atp100w Firmware | from 4.32 before 5.37 Version 5.37 |
| Zyxel | Atp200 Firmware | from 4.32 before 5.37 Version 5.37 |
| Zyxel | Atp500 Firmware | from 4.32 before 5.37 Version 5.37 |
| Zyxel | Atp700 Firmware | from 4.32 before 5.37 Version 5.37 |
| Zyxel | Atp800 Firmware | from 4.32 before 5.37 Version 5.37 |
| Zyxel | Usg Flex 100 Firmware | from 4.50 before 5.37 Version 5.37 |
| Zyxel | Usg Flex 100ax Firmware | from 4.50 before 5.37 Version 5.37 |
| Zyxel | Usg Flex 100h Firmware | from 4.50 before 5.37 Version 5.37 |
| Zyxel | Usg Flex 100w Firmware | from 4.50 before 5.37 Version 5.37 |
| Zyxel | Usg Flex 200 Firmware | from 4.50 before 5.37 Version 5.37 |
| Zyxel | Usg Flex 200h Firmware | from 4.50 before 5.37 Version 5.37 |
Weakness classification
References
- NVD record
- CVE.org record
- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-aps-02-20-2024
- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-aps-02-20-2024