CVE-2023-6764: High severity zyxel atp series firmware vulnerability

Q: What is the severity of CVE-2023-6764?

CVE-2023-6764 is classified as a critical vulnerability due to its potential impact on the security of affected Zyxel devices.

Q: How do I fix CVE-2023-6764?

To address CVE-2023-6764, users should upgrade to the latest patched version of the Zyxel firmware available for their devices.

Q: Which Zyxel products are affected by CVE-2023-6764?

CVE-2023-6764 affects various Zyxel devices including ATP series, USG FLEX series, USG FLEX 50(W), and USG20(W)-VPN firmware versions.

Q: What type of vulnerability is CVE-2023-6764?

CVE-2023-6764 is a format string vulnerability that could allow for code execution or crashes in the affected Zyxel devices.

Q: What are the ramifications of not addressing CVE-2023-6764?

Failing to address CVE-2023-6764 may lead to unauthorized access or control over affected Zyxel devices, significantly compromising network security.

Published Feb 20, 2024

Updated

A format string vulnerability in a function of the IPSec VPN feature in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 through 5.37 Patch 1, and USG20(W)-VPN series firmware versions from 4.16 through 5.37 Patch 1 could allow an attacker to achieve unauthorized remote code execution by sending a sequence of specially crafted payloads containing an invalid pointer; however, such an attack would require detailed knowledge of an affected device’s memory layout and configuration.

Affected Software

88 affected components

Zyxel ATP series firmware>=4.32<5.37 Patch 1

Zyxel USG FLEX series firmware>=4.50<5.37 Patch 1

Zyxel USG FLEX 50(W) series firmware>=4.16<5.37 Patch 1

Zyxel USG20(W)-VPN series firmware>=4.16<5.37 Patch 1

All of the following

Any of the following

Zyxel Atp100 Firmware>=4.32<5.37

Zyxel Atp100 Firmware=5.37

Zyxel Atp100 Firmware=5.37-patch1

Zyxel Atp100

All of the following

Any of the following

Zyxel Atp100w Firmware>=4.32<5.37

Zyxel Atp100w Firmware=5.37

Zyxel Atp100w Firmware=5.37-patch1

Zyxel Atp100w

All of the following

Any of the following

Zyxel Atp200 Firmware>=4.32<5.37

Zyxel Atp200 Firmware=5.37

Zyxel Atp200 Firmware=5.37-patch1

Zyxel ATP200

All of the following

Any of the following

Zyxel Atp500 Firmware>=4.32<5.37

Zyxel Atp500 Firmware=5.37

Zyxel Atp500 Firmware=5.37-patch1

Zyxel ATP500

All of the following

Any of the following

Zyxel Atp700 Firmware>=4.32<5.37

Zyxel Atp700 Firmware=5.37

Zyxel Atp700 Firmware=5.37-patch1

Zyxel Atp700

All of the following

Any of the following

Zyxel Atp800 Firmware>=4.32<5.37

Zyxel Atp800 Firmware=5.37

Zyxel Atp800 Firmware=5.37-patch1

Zyxel ATP800

All of the following

Any of the following

Zyxel Usg Flex 100 Firmware>=4.50<5.37

Zyxel Usg Flex 100 Firmware=5.37

Zyxel Usg Flex 100 Firmware=5.37-patch1

Zyxel Usg Flex 100

All of the following

Any of the following

Zyxel Usg Flex 100ax Firmware>=4.50<5.37

Zyxel Usg Flex 100ax Firmware=5.37

Zyxel Usg Flex 100ax Firmware=5.37-patch1

Zyxel Usg Flex 100ax

All of the following

Any of the following

Zyxel Usg Flex 100h Firmware>=4.50<5.37

Zyxel Usg Flex 100h Firmware=5.37

Zyxel Usg Flex 100h Firmware=5.37-patch1

Zyxel Usg Flex 100h

All of the following

Any of the following

Zyxel Usg Flex 100w Firmware>=4.50<5.37

Zyxel Usg Flex 100w Firmware=5.37

Zyxel Usg Flex 100w Firmware=5.37-patch1

Zyxel Usg Flex 100w

All of the following

Any of the following

Zyxel USG FLEX 200 firmware>=4.50<5.37

Zyxel USG FLEX 200 firmware=5.37

Zyxel USG FLEX 200 firmware=5.37-patch1

Zyxel USG FLEX 200

All of the following

Any of the following

Zyxel Usg Flex 200h Firmware>=4.50<5.37

Zyxel Usg Flex 200h Firmware=5.37

Zyxel Usg Flex 200h Firmware=5.37-patch1

Zyxel Usg Flex 200h

All of the following

Any of the following

Zyxel Usg Flex 200hp Firmware>=4.50<5.37

Zyxel Usg Flex 200hp Firmware=5.37

Zyxel Usg Flex 200hp Firmware=5.37-patch1

Zyxel Usg Flex 200hp

All of the following

Any of the following

Zyxel USG FLEX 500 firmware>=4.50<5.37

Zyxel USG FLEX 500 firmware=5.37

Zyxel USG FLEX 500 firmware=5.37-patch1

Zyxel USG FLEX 500

All of the following

Any of the following

Zyxel Usg Flex 500h Firmware>=4.50<5.37

Zyxel Usg Flex 500h Firmware=5.37

Zyxel Usg Flex 500h Firmware=5.37-patch1

Zyxel Usg Flex 500h

All of the following

Any of the following

Zyxel USG FLEX 700 firmware>=4.50<5.37

Zyxel USG FLEX 700 firmware=5.37

Zyxel USG FLEX 700 firmware=5.37-patch1

Zyxel USG FLEX 700

All of the following

Any of the following

Zyxel Usg Flex 700h Firmware>=4.50<5.37

Zyxel Usg Flex 700h Firmware=5.37

Zyxel Usg Flex 700h Firmware=5.37-patch1

Zyxel Usg Flex 700h

All of the following

Any of the following

Zyxel Usg Flex 50 Firmware>=4.16<5.37

Zyxel Usg Flex 50 Firmware=5.37

Zyxel Usg Flex 50 Firmware=5.37-patch1

Zyxel USG FLEX 50

All of the following

Any of the following

Zyxel Usg Flex 50w Firmware>=4.16<5.37

Zyxel Usg Flex 50w Firmware=5.37

Zyxel Usg Flex 50w Firmware=5.37-patch1

Zyxel Usg Flex 50w

All of the following

Any of the following

Zyxel Usg20-vpn Firmware>=4.16<5.37

Zyxel Usg20-vpn Firmware=5.37

Zyxel Usg20-vpn Firmware=5.37-patch1

Zyxel USG20-VPN

All of the following

Any of the following

Zyxel Usg20w-vpn Firmware>=4.16<5.37

Zyxel Usg20w-vpn Firmware=5.37

Zyxel Usg20w-vpn Firmware=5.37-patch1

Zyxel USG20W-VPN

Event History

Feb 20, 2024

CVE Published

via MITRE·02:14 AM

Data Sourced

via MITRE·02:14 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:15 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2023-6764?

CVE-2023-6764 is classified as a critical vulnerability due to its potential impact on the security of affected Zyxel devices.

How do I fix CVE-2023-6764?

To address CVE-2023-6764, users should upgrade to the latest patched version of the Zyxel firmware available for their devices.

Which Zyxel products are affected by CVE-2023-6764?

CVE-2023-6764 affects various Zyxel devices including ATP series, USG FLEX series, USG FLEX 50(W), and USG20(W)-VPN firmware versions.

What type of vulnerability is CVE-2023-6764?

CVE-2023-6764 is a format string vulnerability that could allow for code execution or crashes in the affected Zyxel devices.

What are the ramifications of not addressing CVE-2023-6764?

Failing to address CVE-2023-6764 may lead to unauthorized access or control over affected Zyxel devices, significantly compromising network security.

CVE-2023-6764: High severity zyxel atp series firmware vulnerability

Affected Software

Event History

Don't miss critical vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2023-6764?

How do I fix CVE-2023-6764?

Which Zyxel products are affected by CVE-2023-6764?

What type of vulnerability is CVE-2023-6764?

What are the ramifications of not addressing CVE-2023-6764?

Company

Resources

Contact