by Kastro
Paper/Archive/CVE-2023-33010

CVE-2023-33010

Zyxel ATP series firmware — Zyxel Multiple Firewalls Buffer Overflow Vulnerability

KEV · due 26 JunEPSS 29%public exploitSSVC actCVSS 9.8
critical.is priorityof 100
99
CVSS 9.8 (CNA)9.8 / 10 × 3029.4In CISA KEV+3030.0EPSS percentile 98.2.982 × 2019.6Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

A buffer overflow vulnerability in the ID processing function in Zyxel ATP series firmware versions 4.32 through 5.36 Patch 1, USG FLEX series firmware versions 4.50 through 5.36 Patch 1, USG FLEX 50(W) firmware versions 4.25 through 5.36 Patch 1, USG20(W)-VPN firmware versions 4.25 through 5.36 Patch 1, VPN series firmware versions 4.30 through 5.36 Patch 1, ZyWALL/USG series firmware versions 4.25 through 4.73 Patch 1, could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and even a remote code execution on an affected device.

Affected

ProductAffectedFixed inSource
ATP series firmware4.32 through 5.36 Patch 1–CNA
USG FLEX series firmware4.50 through 5.36 Patch 1–CNA
USG FLEX 50(W) firmware4.25 through 5.36 Patch 1–CNA
USG20(W)-VPN firmware4.25 through 5.36 Patch 1–CNA
VPN series firmware4.30 through 5.36 Patch 1–CNA
ZyWALL/USG series firmware4.25 through 4.73 Patch 1–CNA

Scores by source

Zyxel (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

refzyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-buffer-overflow-vulnerabilities-of-firewallsrefcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-33010kevcisa.gov/known-exploited-vulnerabilities-catalog