PT-2023-8709 · Zyxel · Zyxel Atp Series+3
Atdog
+1
·
Publicado
2023-11-30
·
Atualizado
2025-01-21
·
CVE-2023-6399
CVSS v3.1
6.5
Média
| Vetor | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Zyxel ATP series versions 4.32 through 5.37 Patch 1
Zyxel USG FLEX series versions 4.50 through 5.37 Patch 1
Zyxel USG FLEX 50(W) series versions 4.16 through 5.37 Patch 1
Zyxel USG20(W)-VPN series versions 4.16 through 5.37 Patch 1
Zyxel USG FLEX H series versions 1.10 through 1.10 Patch 1
Description
A format string vulnerability could allow an authenticated IPSec VPN user to cause DoS conditions against the
deviceid daemon by sending a crafted hostname to an affected device if it has the Device Insight feature enabled. This issue is related to the use of uncontrolled format strings in the Device Insight feature of the affected devices.Recommendations
For Zyxel ATP series versions 4.32 through 5.37 Patch 1, update to a version later than 5.37 Patch 1.
For Zyxel USG FLEX series versions 4.50 through 5.37 Patch 1, update to a version later than 5.37 Patch 1.
For Zyxel USG FLEX 50(W) series versions 4.16 through 5.37 Patch 1, update to a version later than 5.37 Patch 1.
For Zyxel USG20(W)-VPN series versions 4.16 through 5.37 Patch 1, update to a version later than 5.37 Patch 1.
For Zyxel USG FLEX H series versions 1.10 through 1.10 Patch 1, update to a version later than 1.10 Patch 1.
As a temporary workaround, consider disabling the
Device Insight feature until a patch is available.Correção
Use of Externally-Controlled Format String
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Zyxel Atp Series
Zyxel Usg Flex 50(W) Series
Zyxel Usg Flex Series
Zyxel Usg20(W)-Vpn Series