CVE-2023-6397: Null Pointer Dereference
Published Feb 20, 2024
·Updated
A null pointer dereference vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1 and USG FLEX series firmware versions from 4.50 through 5.37 Patch 1 could allow a LAN-based attacker to cause denial-of-service (DoS) conditions by downloading a crafted RAR compressed file onto a LAN-side host if the firewall has the “Anti-Malware” feature enabled.
Affected Software
78 affected components
Zyxel ATP series firmware>=4.32<=5.37 Patch 1
Zyxel USG FLEX series firmware>=4.50<=5.37 Patch 1
All of the following
Any of the following
Zyxel Atp100 Firmware>=4.32<5.37
Zyxel Atp100 Firmware=5.37
Zyxel Atp100 Firmware=5.37-patch1
Zyxel Atp100
All of the following
Any of the following
Zyxel Atp100w Firmware>=4.32<5.37
Zyxel Atp100w Firmware=5.37
Zyxel Atp100w Firmware=5.37-patch1
Zyxel Atp100w
All of the following
Any of the following
Zyxel Atp200 Firmware>=4.32<5.37
Zyxel Atp200 Firmware=5.37
Zyxel Atp200 Firmware=5.37-patch1
Zyxel ATP200
All of the following
Any of the following
Zyxel Atp500 Firmware>=4.32<5.37
Zyxel Atp500 Firmware=5.37
Zyxel Atp500 Firmware=5.37-patch1
Zyxel ATP500
All of the following
Any of the following
Zyxel Atp700 Firmware>=4.32<5.37
Zyxel Atp700 Firmware=5.37
Zyxel Atp700 Firmware=5.37-patch1
Zyxel Atp700
All of the following
Any of the following
Zyxel Atp800 Firmware>=4.32<5.37
Zyxel Atp800 Firmware=5.37
Zyxel Atp800 Firmware=5.37-patch1
Zyxel ATP800
All of the following
Any of the following
Zyxel Usg Flex 100 Firmware>=4.50<5.37
Zyxel Usg Flex 100 Firmware=5.37
Zyxel Usg Flex 100 Firmware=5.37-patch1
Zyxel Usg Flex 100
All of the following
Any of the following
Zyxel Usg Flex 100ax Firmware>=4.50<5.37
Zyxel Usg Flex 100ax Firmware=5.37
Zyxel Usg Flex 100ax Firmware=5.37-patch1
Zyxel Usg Flex 100ax
All of the following
Any of the following
Zyxel Usg Flex 100h Firmware>=4.50<5.37
Zyxel Usg Flex 100h Firmware=5.37
Zyxel Usg Flex 100h Firmware=5.37-patch1
Zyxel Usg Flex 100h
All of the following
Any of the following
Zyxel Usg Flex 100w Firmware>=4.50<5.37
Zyxel Usg Flex 100w Firmware=5.37
Zyxel Usg Flex 100w Firmware=5.37-patch1
Zyxel Usg Flex 100w
All of the following
Any of the following
Zyxel USG FLEX 200 firmware>=4.50<5.37
Zyxel USG FLEX 200 firmware=5.37
Zyxel USG FLEX 200 firmware=5.37-patch1
Zyxel USG FLEX 200
All of the following
Any of the following
Zyxel Usg Flex 200h Firmware>=4.50<5.37
Zyxel Usg Flex 200h Firmware=5.37
Zyxel Usg Flex 200h Firmware=5.37-patch1
Zyxel Usg Flex 200h
All of the following
Any of the following
Zyxel Usg Flex 200hp Firmware>=4.50<5.37
Zyxel Usg Flex 200hp Firmware=5.37
Zyxel Usg Flex 200hp Firmware=5.37-patch1
Zyxel Usg Flex 200hp
All of the following
Any of the following
Zyxel Usg Flex 50 Firmware>=4.50<5.37
Zyxel Usg Flex 50 Firmware=5.37
Zyxel Usg Flex 50 Firmware=5.37-patch1
Zyxel USG FLEX 50
All of the following
Any of the following
Zyxel USG FLEX 500 firmware>=4.50<5.37
Zyxel USG FLEX 500 firmware=5.37
Zyxel USG FLEX 500 firmware=5.37-patch1
Zyxel USG FLEX 500
All of the following
Any of the following
Zyxel Usg Flex 500h Firmware>=4.50<5.37
Zyxel Usg Flex 500h Firmware=5.37
Zyxel Usg Flex 500h Firmware=5.37-patch1
Zyxel Usg Flex 500h
All of the following
Any of the following
Zyxel Usg Flex 50w Firmware>=4.50<5.37
Zyxel Usg Flex 50w Firmware=5.37
Zyxel Usg Flex 50w Firmware=5.37-patch1
Zyxel Usg Flex 50w
All of the following
Any of the following
Zyxel USG FLEX 700 firmware>=4.50<5.37
Zyxel USG FLEX 700 firmware=5.37
Zyxel USG FLEX 700 firmware=5.37-patch1
Zyxel USG FLEX 700
All of the following
Any of the following
Zyxel Usg Flex 700h Firmware>=4.50<5.37
Zyxel Usg Flex 700h Firmware=5.37
Zyxel Usg Flex 700h Firmware=5.37-patch1
Zyxel Usg Flex 700h
Event History
Feb 20, 2024
CVE Published
via MITRE·01:19 AM
Data Sourced
via MITRE·01:19 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·02:15 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2023-6397?
CVE-2023-6397 is classified as a denial-of-service vulnerability.
2
How do I fix CVE-2023-6397?
To fix CVE-2023-6397, update Zyxel ATP and USG FLEX series firmware to versions 5.37 Patch 2 or later.
3
Which Zyxel firmware versions are affected by CVE-2023-6397?
CVE-2023-6397 affects Zyxel ATP series firmware versions 4.32 to 5.37 Patch 1 and USG FLEX series firmware versions 4.50 to 5.37 Patch 1.
4
Can CVE-2023-6397 be exploited remotely?
CVE-2023-6397 requires a LAN-based attacker to exploit the vulnerability.
5
What type of attack can CVE-2023-6397 facilitate?
CVE-2023-6397 can cause denial-of-service (DoS) conditions on affected devices.