← CVE Radar
CVE-2023-33010Zyxel Multiple Firewalls Buffer Overflow Vulnerability
A buffer overflow vulnerability in the ID processing function in Zyxel ATP series firmware versions 4.32 through 5.36 Patch 1, USG FLEX series firmware versions 4.50 through 5.36 Patch 1, USG FLEX 50(W) firmware versions 4.25 through 5.36 Patch 1, USG20(W)-VPN firmware versions 4.25 through 5.36 Patch 1, VPN series firmware versions 4.30 through 5.36 Patch 1, ZyWALL/USG series firmware versions 4.25 through 4.73 Patch 1, could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and even a remote code execution on an affected device.
9.8 CRITICALEPSS 29.02%⚡ Known Exploited (CISA KEV)NVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 9.8 | CRITICAL | 3.1Zyxel (CNA) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
CISA required action
⚡ Known exploited · remediation due Jun 26, 2023
Apply updates per vendor instructions.
Details
- CVE ID
- CVE-2023-33010
- Status
- Analyzed
- Assigner (CNA)
- Zyxel
- Published
- May 24, 2023
- Last modified
- 2026-06-17 06:00 UTC
- Weaknesses
- CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected Products
As published by the CNA in the CVE record.
ZyxelATP series firmware1 version range
- 4.32 through 5.36 Patch 1
ZyxelUSG FLEX series firmware1 version range
- 4.50 through 5.36 Patch 1
ZyxelUSG FLEX 50(W) firmware1 version range
- 4.25 through 5.36 Patch 1
ZyxelUSG20(W)-VPN firmware1 version range
- 4.25 through 5.36 Patch 1
ZyxelVPN series firmware1 version range
- 4.30 through 5.36 Patch 1
ZyxelZyWALL/USG series firmware1 version range
- 4.25 through 4.73 Patch 1