Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2023-33009

A buffer overflow vulnerability in the notification function in Zyxel ATP series firmware versions 4.60 through 5.36 Patch 1, USG FLEX serie

Published
Last modified
published
Listed in CISA KEV
None on Exploit-DB, Metasploit or GitHub

Summary

The affected software is Zyxel ATP, USG FLEX, USG20(W)-VPN, VPN, and ZyWALL/USG series firmware, which are security gateway and firewall devices. An unauthenticated remote attacker could exploit this flaw to crash the device (denial of service) or potentially run their own code on it.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Read the original description

A buffer overflow vulnerability in the notification function in Zyxel ATP series firmware versions 4.60 through 5.36 Patch 1, USG FLEX series firmware versions 4.60 through 5.36 Patch 1, USG FLEX 50(W) firmware versions 4.60 through 5.36 Patch 1, USG20(W)-VPN firmware versions 4.60 through 5.36 Patch 1, VPN series firmware versions 4.60 through 5.36 Patch 1, ZyWALL/USG series firmware versions 4.60 through 4.73 Patch 1, could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and even a remote code execution on an affected device.

Timeline

  1. CVE published
  2. Added to CISA KEV

    CISA has evidence of exploitation in the wild

  3. CISA remediation deadline

    Due date for US federal agencies to patch

  4. Record last updated
  5. EPSS reached 10%

    FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

  • Zyxel ATP series firmware

    4.60 through 5.36 Patch 1

  • Zyxel USG FLEX series firmware

    4.60 through 5.36 Patch 1

  • Zyxel USG FLEX 50(W) firmware

    4.60 through 5.36 Patch 1

  • Zyxel USG20(W)-VPN firmware

    4.60 through 5.36 Patch 1

  • Zyxel VPN series firmware

    4.60 through 5.36 Patch 1

  • Zyxel ZyWALL/USG series firmware

    4.60 through 4.73 Patch 1

References 1

zyxel.com