Zyxel · Multiple Firewalls
CVE-2023-33009
Zyxel Multiple Firewalls Buffer Overflow Vulnerability
What it is
A buffer overflow vulnerability in the notification function in Zyxel ATP series firmware versions 4.60 through 5.36 Patch 1, USG FLEX series firmware versions 4.60 through 5.36 Patch 1, USG FLEX 50(W) firmware versions 4.60 through 5.36 Patch 1, USG20(W)-VPN firmware versions 4.60 through 5.36 Patch 1, VPN series firmware versions 4.60 through 5.36 Patch 1, ZyWALL/USG series firmware versions 4.60 through 4.73 Patch 1, could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and even a remote code execution on an affected device.
CISA: Zyxel ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN, and ZyWALL/USG firewalls contain a buffer overflow vulnerability in the notification function that could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and remote code execution on an affected device.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: June 26, 2023
More exploited flaws from Zyxel
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Dec 3, 2024 | Path Traversal | Multiple Firewalls | High 7.5 | 2.9% |
| Jun 5, 2023 | Buffer Overflow | Multiple Firewalls | Critical 9.8 | 29% |
| May 31, 2023 | OS Command Injection | Multiple Firewalls | Critical 9.8 | 99.3% |
| May 16, 2022 | OS Command Injection | Multiple Firewalls | Critical 9.8 | 99.9% |
| Sep 21, 2026 | Stack-Based Buffer Overflow | GS1900 Series Switches | High 8.8 | 2.8% |
| Feb 11, 2025 | DSL CPE OS Command Injection | DSL CPE Devices | High 8.8 | 21% |
| Feb 11, 2025 | DSL CPE OS Command Injection | DSL CPE Devices | High 8.8 | 23% |
| Sep 18, 2023 | Command Injection | EMG2926 Routers | High 8.8 | 33% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.