← CVE Radar
CVE-2023-33009Zyxel Multiple Firewalls Buffer Overflow Vulnerability
A buffer overflow vulnerability in the notification function in Zyxel ATP series firmware versions 4.60 through 5.36 Patch 1, USG FLEX series firmware versions 4.60 through 5.36 Patch 1, USG FLEX 50(W) firmware versions 4.60 through 5.36 Patch 1, USG20(W)-VPN firmware versions 4.60 through 5.36 Patch 1, VPN series firmware versions 4.60 through 5.36 Patch 1, ZyWALL/USG series firmware versions 4.60 through 4.73 Patch 1, could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and even a remote code execution on an affected device.
9.8 CRITICALEPSS 28.14%⚡ Known Exploited (CISA KEV)NVD: Published
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 9.8 | CRITICAL | 3.1Zyxel (CNA) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Details
- CVE ID
- CVE-2023-33009
- Status
- Published
- Assigner (CNA)
- Zyxel
- Published
- May 24, 2023
- Last modified
- 2025-10-21 23:05 UTC
- Weaknesses
- CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected Products
As published by the CNA in the CVE record.
ZyxelATP series firmware1 version range
- 4.60 through 5.36 Patch 1
ZyxelUSG FLEX series firmware1 version range
- 4.60 through 5.36 Patch 1
ZyxelUSG FLEX 50(W) firmware1 version range
- 4.60 through 5.36 Patch 1
ZyxelUSG20(W)-VPN firmware1 version range
- 4.60 through 5.36 Patch 1
ZyxelVPN series firmware1 version range
- 4.60 through 5.36 Patch 1
ZyxelZyWALL/USG series firmware1 version range
- 4.60 through 4.73 Patch 1
References
Sources
- NVD (unavailable at last refresh)
- CVE.org
- CISA KEV
- FIRST EPSS