CVE-2023-33010

Zyxel ATP series firmware, Zyxel USG FLEX series firmware, Zyxel USG FLEX 50(W) firmware

Published 24 May 2023 · updated 17 Jun 2026 · Analyzed

9.8 Critical · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 5 Jun 2023, with a remediation deadline of 26 Jun 2023 for US federal agencies.

Required action: Apply updates per vendor instructions.

Description

A buffer overflow vulnerability in the ID processing function in Zyxel ATP series firmware versions 4.32 through 5.36 Patch 1, USG FLEX series firmware versions 4.50 through 5.36 Patch 1, USG FLEX 50(W) firmware versions 4.25 through 5.36 Patch 1, USG20(W)-VPN firmware versions 4.25 through 5.36 Patch 1, VPN series firmware versions 4.30 through 5.36 Patch 1, ZyWALL/USG series firmware versions 4.25 through 4.73 Patch 1, could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and even a remote code execution on an affected device.

References

www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-buffer-overflow-vulnerabilities-of-firewalls · Vendor Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-33010 · US Government Resource