CVE-2023-33009

Katalog CVE

CVSS 9.8 · Critical KEV · sudah dieksploitasi EPSS 28,1%

Kerentanan Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') pada zyxel atp100 firmware, zyxel atp200 firmware +18 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut zyxel.com.tw. Masuk katalog KEV CISA pada 5 Juni 2023, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

A buffer overflow vulnerability in the notification function in Zyxel ATP series firmware versions 4.60 through 5.36 Patch 1, USG FLEX series firmware versions 4.60 through 5.36 Patch 1, USG FLEX 50(W) firmware versions 4.60 through 5.36 Patch 1, USG20(W)-VPN firmware versions 4.60 through 5.36 Patch 1, VPN series firmware versions 4.60 through 5.36 Patch 1, ZyWALL/USG series firmware versions 4.60 through 4.73 Patch 1, could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and even a remote code execution on an affected device.

Rincian

Terbit di NVD

24 Mei 2023

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber zyxel.com.tw
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

EPSS (30 hari)

28,1% peluang dieksploitasi; lebih tinggi dari 98,0% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Zyxel Multiple Firewalls Buffer Overflow Vulnerability

Masuk KEV

5 Juni 2023

Tenggat CISA

26 Juni 2023 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD. Ditampilkan 60 dari 69 konfigurasi; daftar lengkap ada di NVD.

Referensi dan perbaikan

• https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-buffer-overfl... advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-33009 pemerintah AS