PT-2024-6029 · Zyxel · Zyxel Usg Flex Series+3
Nella17
·
Published
2024-07-29
·
Updated
2024-12-13
·
CVE-2024-42058
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Zyxel ATP series versions V4.32 through V5.38
Zyxel USG FLEX series versions V4.50 through V5.38
Zyxel USG FLEX 50(W) series versions V5.20 through V5.38
Zyxel USG20(W)-VPN series versions V5.20 through V5.38
Description
A null pointer dereference issue could allow an unauthenticated attacker to cause DoS conditions by sending crafted packets to a vulnerable device. This issue is related to errors in pointer dereferencing, which can be exploited by a remote attacker to cause a denial of service.
Recommendations
For Zyxel ATP series versions V4.32 through V5.38, update to a version outside of this range to mitigate the risk.
For Zyxel USG FLEX series versions V4.50 through V5.38, update to a version outside of this range to mitigate the risk.
For Zyxel USG FLEX 50(W) series versions V5.20 through V5.38, update to a version outside of this range to mitigate the risk.
For Zyxel USG20(W)-VPN series versions V5.20 through V5.38, update to a version outside of this range to mitigate the risk.
As a temporary workaround, consider restricting access to the vulnerable devices until a patch is available.
Fix
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Zyxel Atp Series
Zyxel Usg Flex 50(W) Series
Zyxel Usg Flex Series
Zyxel Usg20(W)-Vpn Series