Skip to content
CVE PROGRAM SOURCE RECORD5.7 Medium

CVE-2023-6399

A format string vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W)

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Zyxel

Description

A format string vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 through 5.37 Patch 1, USG20(W)-VPN series firmware versions from 4.16 through 5.37 Patch 1, and USG FLEX H series firmware versions from 1.10 through 1.10 Patch 1 could allow an authenticated IPSec VPN user to cause DoS conditions against the “deviceid” daemon by sending a crafted hostname to an affected device if it has the “Device Insight” feature enabled.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Zyxel ATP series firmware

Default version status: unaffected

  • version 4.32 through 5.37 Patch 1affected

Zyxel USG FLEX series firmware

Default version status: unaffected

  • version 4.50 through 5.37 Patch 1affected

Zyxel USG FLEX 50(W) series firmware

Default version status: unaffected

  • version 4.16 through 5.37 Patch 1affected

Zyxel USG20(W)-VPN series firmware

Default version status: unaffected

  • version 4.16 through 5.37 Patch 1affected

Zyxel USG FLEX H series firmware

Default version status: unaffected

  • version 1.10 through 1.10 Patch 1affected

References