CVE-2023-33010

CVE-2023-33010 is a critical-severity (CVSS 9.8) vulnerability in Zyxel Multiple Firewalls. CISA added it to the Known Exploited Vulnerabilities catalog on June 5, 2023, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by June 26, 2023. CISA does not currently list it as used in ransomware campaigns. Zyxel has 13 vulnerabilities in the KEV catalog, 2 of them linked to ransomware.

A buffer overflow vulnerability in the ID processing function in Zyxel ATP series firmware versions 4.32 through 5.36 Patch 1, USG FLEX series firmware versions 4.50 through 5.36 Patch 1, USG FLEX 50(W) firmware versions 4.25 through 5.36 Patch 1, USG20(W)-VPN firmware versions 4.25 through 5.36 Patch 1, VPN series firmware versions 4.30 through 5.36 Patch 1, ZyWALL/USG series firmware versions 4.25 through 4.73 Patch 1, could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and even a remote code execution on an affected device.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-buffer-overflow-vulnerabilities-of-firewalls
• https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-buffer-overflow-vulnerabilities-of-firewalls
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-33010