Integer Overflow Vulnerability in Zyxel ATP and USG FLEX Series Firmware
CVE-2023-4398

7.5HIGH

Key Information:

Vendor
Zyxel
Status
Atp Series Firmware
Usg Flex Series Firmware
Usg Flex 50(w) Series Firmware
Usg20(w)-vpn Series Firmware
Vendor
CVE Published:
28 November 2023

Summary

An integer overflow vulnerability exists in the QuickSec IPSec toolkit that could allow an unauthenticated attacker to exploit the VPN functionality in impacted Zyxel devices. By sending a specially crafted IKE packet, the attacker may initiate a denial-of-service (DoS) condition, causing affected devices to become unresponsive. This vulnerability affects multiple firmware versions of Zyxel's ATP and USG FLEX series, posing significant security risks if not addressed.

Affected Version(s)

ATP series firmware versions 4.32 through 5.37

USG FLEX 50(W) series firmware versions 4.16 through 5.37

USG FLEX series firmware versions 4.50 through 5.37

References

https://www.zyxel.com/global/en/support/security-advisori...
vendor-advisory

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.