Buffer Overflow Vulnerability in Zyxel ATP and USG FLEX Series Firmware
CVE-2023-34140

6.5MEDIUM

Key Information:

Vendor

Zyxel
Status
Atp Series Firmware
Usg Flex Series Firmware
Usg Flex 50(w) Series Firmware
Usg20(w)-vpn Series Firmware
Vendor
CVE Published:
17 July 2023

What is CVE-2023-34140?

A buffer overflow risk exists in multiple Zyxel firmware versions, enabling a possible denial of service (DoS) through the CAPWAP daemon. This vulnerability allows an unauthenticated attacker on the local area network (LAN) to manipulate crafted requests, potentially leading to service disruptions. Users are urged to update their firmware to mitigate these risks.

Affected Version(s)

ATP series firmware 4.32 through 5.36 Patch 2

NXC2500 firmware 6.10(AAIG.0) through 6.10(AAIG.3)

NXC5500 firmware 6.10(AAOS.0) through 6.10(AAOS.4)

References

https://www.zyxel.com/global/en/support/security-advisori...
vendor-advisory

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2023-34140 : Buffer Overflow Vulnerability in Zyxel ATP and USG FLEX Series Firmware