CVE-2023-33011

State: Published
Severity: 8.8 High
Published: Jul 17, 2023
Updated: Nov 7, 2024
Reserved: May 17, 2023

Description

A format string vulnerability in the Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through 5.36 Patch 2, USG FLEX 50(W) series firmware versions 5.10 through 5.36 Patch 2, USG20(W)-VPN series firmware versions 5.10 through 5.36 Patch 2, and VPN series firmware versions 5.00 through 5.36 Patch 2, could allow an unauthenticated, LAN-based attacker to execute some OS commands by using a crafted PPPoE configuration on an affected device when the cloud management mode is enabled.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Zyxel

Weaknesses

CWE-134 Use of Externally-Controlled Format String

Affected Products

Product	Versions
ATP series firmwareZyxel	5.10 through 5.36 Patch 2Affected
USG FLEX series firmwareZyxel	5.00 through 5.36 Patch 2Affected
USG FLEX 50(W) series firmwareZyxel	5.10 through 5.36 Patch 2Affected
USG20(W)-VPN series firmwareZyxel	5.10 through 5.36 Patch 2Affected
VPN series firmwareZyxel	5.00 through 5.36 Patch 2Affected

References

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-wlan-controllers

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.