CVE-2023-34140

State: Published
Severity: 6.5 Medium
Published: Jul 17, 2023
Updated: Oct 21, 2024
Reserved: May 26, 2023

Description

A buffer overflow vulnerability in the Zyxel ATP series firmware versions 4.32 through 5.36 Patch 2, USG FLEX series firmware versions 4.50 through 5.36 Patch 2, USG FLEX 50(W) series firmware versions 4.16 through 5.36 Patch 2, USG20(W)-VPN series firmware versions 4.16 through 5.36 Patch 2, VPN series firmware versions 4.30 through 5.36 Patch 2, NXC2500 firmware versions 6.10(AAIG.0) through 6.10(AAIG.3), and NXC5500 firmware versions 6.10(AAOS.0) through 6.10(AAOS.4), could allow an unauthenticated, LAN-based attacker to cause denial of service (DoS) conditions by sending a crafted request to the CAPWAP daemon.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	Zyxel

Weaknesses

CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Affected Products

Product	Versions
ATP series firmwareZyxel	4.32 through 5.36 Patch 2Affected
USG FLEX series firmwareZyxel	4.50 through 5.36 Patch 2Affected
USG FLEX 50(W) series firmwareZyxel	4.16 through 5.36 Patch 2Affected
USG20(W)-VPN series firmwareZyxel	4.16 through 5.36 Patch 2Affected
VPN series firmwareZyxel	4.30 through 5.36 Patch 2Affected
NXC2500 firmwareZyxel	6.10(AAIG.0) through 6.10(AAIG.3)Affected
NXC5500 firmwareZyxel	6.10(AAOS.0) through 6.10(AAOS.4)Affected

References

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-wlan-controllersvendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.