Vulnerability · Published Feb 20, 2024 · Assigned by Zyxel
CVE-2023-6399
Medium 5.7
In plain English
A medium-severity security flaw in ATP series firmware from Zyxel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities).
Official description
A format string vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 through 5.37 Patch 1, USG20(W)-VPN series firmware versions from 4.16 through 5.37 Patch 1, and USG FLEX H series firmware versions from 1.10 through 1.10 Patch 1 could allow an authenticated IPSec VPN user to cause DoS conditions against the “deviceid” daemon by sending a crafted hostname to an affected device if it has the “Device Insight” feature enabled.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Zyxel | ATP series firmware | version 4.32 through 5.37 Patch 1 |
| Zyxel | USG FLEX series firmware | version 4.50 through 5.37 Patch 1 |
| Zyxel | USG FLEX 50(W) series firmware | version 4.16 through 5.37 Patch 1 |
| Zyxel | USG20(W)-VPN series firmware | version 4.16 through 5.37 Patch 1 |
| Zyxel | USG FLEX H series firmware | version 1.10 through 1.10 Patch 1 |
Weakness: CWE-134 · Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H