PT-2023-2852 · Zyxel · Zyxel Usg20(W)-Vpn+5

Atdog + 1 · Publicado 2023-05-24 · Atualizado 2025-09-17 · CVE-2023-33009

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zyxel ATP series firmware versions 4.32 through 5.36 Patch 1 Zyxel USG FLEX series firmware versions 4.50 through 5.36 Patch 1 Zyxel USG FLEX 50(W) firmware versions 4.25 through 5.36 Patch 1 Zyxel USG20(W)-VPN firmware versions 4.25 through 5.36 Patch 1 Zyxel VPN series firmware versions 4.30 through 5.36 Patch 1 Zyxel ZyWALL/USG series firmware versions 4.25 through 4.73 Patch 1

Description A buffer overflow vulnerability in the notification function could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and even a remote code execution on an affected device. The vulnerability is related to a lack of size checking for input data, which can be exploited by a remote attacker.

Recommendations For Zyxel ATP series firmware versions 4.32 through 5.36 Patch 1, update to a version later than 5.36 Patch 1. For Zyxel USG FLEX series firmware versions 4.50 through 5.36 Patch 1, update to a version later than 5.36 Patch 1. For Zyxel USG FLEX 50(W) firmware versions 4.25 through 5.36 Patch 1, update to a version later than 5.36 Patch 1. For Zyxel USG20(W)-VPN firmware versions 4.25 through 5.36 Patch 1, update to a version later than 5.36 Patch 1. For Zyxel VPN series firmware versions 4.30 through 5.36 Patch 1, update to a version later than 5.36 Patch 1. For Zyxel ZyWALL/USG series firmware versions 4.25 through 4.73 Patch 1, update to a version later than 4.73 Patch 1. As a temporary workaround, consider disabling the notification function until a patch is available.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-120

Identificadores relacionados

BDU:2023-02797

CVE-2023-33009

Produtos afetados

Zyxel Atp Series

Zyxel Usg Flex 50

Zyxel Usg Flex Series

Zyxel Usg20(W)-Vpn

Zyxel Vpn Series

Zyxel Usg/Zywall Series

Referências · 20

• https://nvd.nist.gov/vuln/detail/CVE-2023-33009 · Nota de Segurança
• https://t.me/cvenotify/52381 · Publicação no Telegram
• https://t.me/pentestingnews/36261 · Publicação no Telegram
• https://t.me/cvenotify/51041 · Publicação no Telegram
• https://twitter.com/clovernetics/status/1707727919077036083 · Publicação no Twitter
• https://t.me/cvenotify/75368 · Publicação no Telegram
• https://twitter.com/pedri77/status/1711129400341672374 · Publicação no Twitter
• https://twitter.com/fletch_ai/status/1699665558025773328 · Publicação no Twitter
• https://t.me/opennews/11498 · Publicação no Telegram
• https://t.me/cibsecurity/64677 · Publicação no Telegram
• https://t.me/pentestingnews/36607 · Publicação no Telegram
• https://t.me/true_secator/4429 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-33009 · Aviso do Fabricante
• https://zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-buffer-overflow-vulnerabilities-of-firewalls · Aviso do Fabricante, Nota de Segurança
• https://twitter.com/fletch_ai/status/1706943522778026406 · Publicação no Twitter