CVE-2023-33009criticalunder attackCWE-120

CVE-2023-33009: critical vulnerability in Zyxel ATP series firmware

Published · Updated

Follow this CVE+ Monitor USG FLEX series+ Monitor ATP series

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

63Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 9.8epss 28%
from disclosure to weapon
Published on NVDMay 24
CISA KEV+12d
Action required by CISAfederal deadline: 2023-06-26

Apply updates per vendor instructions.

In short

A buffer overflow flaw in Zyxel network devices allows attackers to crash the device or take complete control of it without needing to log in. This affects multiple device models running certain firmware versions.

Technical detail

Buffer overflow in the notification function exploitable by unauthenticated remote attackers via malformed input, enabling denial-of-service and arbitrary code execution on affected Zyxel ATP, USG FLEX, USG20, VPN, and ZyWALL/USG series devices running firmware versions 4.60 through 5.36 Patch 1 (or 4.73 Patch 1 for ZyWALL/USG).

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A buffer overflow vulnerability in the notification function in Zyxel ATP series firmware versions 4.60 through 5.36 Patch 1, USG FLEX series firmware versions 4.60 through 5.36 Patch 1, USG FLEX 50(W) firmware versions 4.60 through 5.36 Patch 1, USG20(W)-VPN firmware versions 4.60 through 5.36 Patch 1, VPN series firmware versions 4.60 through 5.36 Patch 1, ZyWALL/USG series firmware versions 4.60 through 4.73 Patch 1, could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and even a remote code execution on an affected device.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Zyxel · ATP series firmwareZyxel · USG20(W)-VPN firmwareZyxel · USG FLEX 50(W) firmwareZyxel · USG FLEX series firmwareZyxel · VPN series firmwareZyxel · ZyWALL/USG series firmware
Related CVEs — Zyxel ATP series firmware

In the same product, most dangerous first.

CVE-2022-30525CRITICALCVE-2022-30525EPSS 99.9%KEVCVE-2023-28771CRITICALCVE-2023-28771EPSS 99.3%KEVCVE-2023-33010CRITICALCVE-2023-33010EPSS 29.0%KEVCVE-2024-11667HIGHCVE-2024-11667EPSS 3.0%KEVCVE-2022-0342CRITICALCVE-2022-0342EPSS 95.1%CVE-2023-33012HIGHCVE-2023-33012EPSS 9.9%