CVE-2023-33009
CVE-2023-33009
In short
A buffer overflow flaw in Zyxel network devices allows attackers to crash the device or take complete control of it without needing to log in. This affects multiple device models running certain firmware versions.
Technical detail
Buffer overflow in the notification function exploitable by unauthenticated remote attackers via malformed input, enabling denial-of-service and arbitrary code execution on affected Zyxel ATP, USG FLEX, USG20, VPN, and ZyWALL/USG series devices running firmware versions 4.60 through 5.36 Patch 1 (or 4.73 Patch 1 for ZyWALL/USG).
Summary generated and translated by AI from the official description.
A buffer overflow vulnerability in the notification function in Zyxel ATP series firmware versions 4.60 through 5.36 Patch 1, USG FLEX series firmware versions 4.60 through 5.36 Patch 1, USG FLEX 50(W) firmware versions 4.60 through 5.36 Patch 1, USG20(W)-VPN firmware versions 4.60 through 5.36 Patch 1, VPN series firmware versions 4.60 through 5.36 Patch 1, ZyWALL/USG series firmware versions 4.60 through 4.73 Patch 1, could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and even a remote code execution on an affected device.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Zyxel · ATP series firmwareZyxel · USG20(W)-VPN firmwareZyxel · USG FLEX 50(W) firmwareZyxel · USG FLEX series firmwareZyxel · VPN series firmwareZyxel · ZyWALL/USG series firmwareWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →