CVE-2023-22917: Buffer Overflow

Q: What is the vulnerability ID of this security issue?

The vulnerability ID is CVE-2023-22917.

Q: What is the severity level of CVE-2023-22917?

The severity level of CVE-2023-22917 is high (7.5).

Q: Which products are affected by CVE-2023-22917?

The Zyxel ATP series firmware versions 5.10 through 5.32, USG FLEX series firmware versions 5.00 through 5.32, USG FLEX 50(W) firmware versions 5.10 through 5.32, USG20(W)-VPN firmware versions 5.10 through 5.32, and VPN series firmware versions 5.00 through 5.35 are affected by CVE-2023-22917.

Q: What is the CVE-2023-22917 vulnerability about?

CVE-2023-22917 is a buffer overflow vulnerability in the 'sdwan_iface_ipc' binary of Zyxel ATP series and other affected firmware versions.

Q: Is there a fix available for CVE-2023-22917?

Yes, Zyxel has released firmware updates to fix the CVE-2023-22917 vulnerability. Please refer to the Zyxel Security Advisory for more information.

Published Apr 24, 2023

Updated

A buffer overflow vulnerability in the “sdwanifaceipc” binary of Zyxel ATP series firmware versions 5.10 through 5.32, USG FLEX series firmware versions 5.00 through 5.32, USG FLEX 50(W) firmware versions 5.10 through 5.32, USG20(W)-VPN firmware versions 5.10 through 5.32, and VPN series firmware versions 5.00 through 5.35, which could allow a remote unauthenticated attacker to cause a core dump with a request error message on a vulnerable device by uploading a crafted configuration file.

Affected Software

36 affected components

Zyxel Usg Flex 100 Firmware>=5.00<=5.32

Zyxel Usg Flex 100

Zyxel Usg Flex 100w Firmware>=5.00<=5.32

Zyxel Usg Flex 100w

Zyxel USG FLEX 200 firmware>=5.00<=5.32

Zyxel USG FLEX 200

Zyxel Usg Flex 50 Firmware>=5.00<=5.32

Zyxel USG FLEX 50

Zyxel Usg Flex 50w Firmware>=5.10<=5.32

Zyxel Usg Flex 50w

Zyxel USG FLEX 500 firmware>=5.00<=5.32

Zyxel USG FLEX 500

Zyxel USG FLEX 700 firmware>=5.00<=5.32

Zyxel USG FLEX 700

Zyxel Vpn100 Firmware>=5.00<=5.35

Zyxel Vpn100

Zyxel Vpn1000 Firmware>=5.00<=5.35

Zyxel Vpn1000

Zyxel Vpn300 Firmware>=5.00<=5.35

Zyxel Vpn300

Zyxel Vpn50 Firmware>=5.00<=5.35

Zyxel Vpn50

Zyxel Usg 20w-vpn Firmware>=5.10<=5.32

Zyxel Usg 20w-vpn

Zyxel Atp100 Firmware>=5.10<=5.32

Zyxel Atp100

Zyxel Atp100w Firmware>=5.10<=5.32

Zyxel Atp100w

Zyxel Atp200 Firmware>=5.10<=5.32

Zyxel ATP200

Zyxel Atp500 Firmware>=5.10<=5.32

Zyxel ATP500

Zyxel Atp700 Firmware>=5.10<=5.32

Zyxel Atp700

Zyxel Atp800 Firmware>=5.10<=5.32

Zyxel ATP800

Event History

Apr 24, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the vulnerability ID of this security issue?

The vulnerability ID is CVE-2023-22917.

What is the severity level of CVE-2023-22917?

The severity level of CVE-2023-22917 is high (7.5).

Which products are affected by CVE-2023-22917?

The Zyxel ATP series firmware versions 5.10 through 5.32, USG FLEX series firmware versions 5.00 through 5.32, USG FLEX 50(W) firmware versions 5.10 through 5.32, USG20(W)-VPN firmware versions 5.10 through 5.32, and VPN series firmware versions 5.00 through 5.35 are affected by CVE-2023-22917.

What is the CVE-2023-22917 vulnerability about?

CVE-2023-22917 is a buffer overflow vulnerability in the 'sdwan_iface_ipc' binary of Zyxel ATP series and other affected firmware versions.

Is there a fix available for CVE-2023-22917?