PT-2023-7254 · Zyxel · Zyxel Atp Series+4

Alessandro Sgreccia

·

Published

2023-07-11

·

Updated

2023-12-04

·

CVE-2023-37926

CVSS v3.1

5.5

Medium

VectorAV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions Zyxel ATP series versions 4.32 through 5.37 Zyxel USG FLEX series versions 4.50 through 5.37 Zyxel USG FLEX 50(W) series versions 4.16 through 5.37 Zyxel USG20(W)-VPN series versions 4.16 through 5.37 Zyxel VPN series versions 4.30 through 5.37
Description A buffer overflow vulnerability could allow an authenticated local attacker to cause denial-of-service (DoS) conditions by executing the CLI command to dump system logs on an affected device. The vulnerability is related to a buffer overflow in the firmware of the affected devices.
Recommendations For Zyxel ATP series versions 4.32 through 5.37, update to a version that fixes the buffer overflow vulnerability. For Zyxel USG FLEX series versions 4.50 through 5.37, update to a version that fixes the buffer overflow vulnerability. For Zyxel USG FLEX 50(W) series versions 4.16 through 5.37, update to a version that fixes the buffer overflow vulnerability. For Zyxel USG20(W)-VPN series versions 4.16 through 5.37, update to a version that fixes the buffer overflow vulnerability. For Zyxel VPN series versions 4.30 through 5.37, update to a version that fixes the buffer overflow vulnerability. As a temporary workaround, consider restricting access to the CLI command to dump system logs on affected devices until a patch is available.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119CWE-120

Related Identifiers

BDU:2023-08282
CVE-2023-37926

Affected Products

Zyxel Atp Series
Zyxel Usg Flex 50(W) Series
Zyxel Usg Flex Series
Zyxel Usg20(W)-Vpn Series
Zyxel Vpn Series