Riskcovery

CVE-2023-33009

State
Published
Severity
9.8 Critical
Published
May 24, 2023
Updated
Oct 21, 2025
Reserved
May 17, 2023

Read the record on cve.org

Description

A buffer overflow vulnerability in the notification function in Zyxel ATP series firmware versions 4.60 through 5.36 Patch 1, USG FLEX series firmware versions 4.60 through 5.36 Patch 1, USG FLEX 50(W) firmware versions 4.60 through 5.36 Patch 1, USG20(W)-VPN firmware versions 4.60 through 5.36 Patch 1, VPN series firmware versions 4.60 through 5.36 Patch 1, ZyWALL/USG series firmware versions 4.60 through 4.73 Patch 1, could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and even a remote code execution on an affected device.

Scores

CVSSScoreVectorSource
3.19.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HZyxel

Weaknesses

  • CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Affected Products

ProductVersions
ATP series firmwareZyxel
  • 4.60 through 5.36 Patch 1Affected
USG FLEX series firmwareZyxel
  • 4.60 through 5.36 Patch 1Affected
USG FLEX 50(W) firmwareZyxel
  • 4.60 through 5.36 Patch 1Affected
USG20(W)-VPN firmwareZyxel
  • 4.60 through 5.36 Patch 1Affected
VPN series firmwareZyxel
  • 4.60 through 5.36 Patch 1Affected
ZyWALL/USG series firmwareZyxel
  • 4.60 through 4.73 Patch 1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.