CVE-2023-34140
moderate-risk
Published 2023-07-17
A buffer overflow vulnerability in the Zyxel ATP series firmware versions 4.32 through 5.36 Patch 2, USG FLEX series firmware versions 4.50 through 5.36 Patch 2, USG FLEX 50(W) series firmware versions 4.16 through 5.36 Patch 2, USG20(W)-VPN series firmware versions 4.16 through 5.36 Patch 2, VPN series firmware versions 4.30 through 5.36 Patch 2, NXC2500 firmware versions 6.10(AAIG.0) through 6.10(AAIG.3), and NXC5500 firmware versions 6.10(AAOS.0) through 6.10(AAOS.4), could allow an unauthenticated, LAN-based attacker to cause denial of service (DoS) conditions by sending a crafted request to the CAPWAP daemon.
Do I need to act?
-
0.11% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
6
CVSS 6.5/10
Medium
ADJACENT_NETWORK
/ LOW complexity
Affected Products (20)
Usg 20W-Vpn Firmware
Usg 2200-Vpn Firmware
Zywall Atp100 Firmware
Zywall Atp100W Firmware
Zywall Atp200 Firmware
Zywall Atp500 Firmware
Zywall Atp700 Firmware
Zywall Atp800 Firmware
Zywall Vpn100 Firmware
Zywall Vpn2S Firmware
Zywall Vpn300 Firmware
Zywall Vpn50 Firmware
Zywall Vpn 100 Firmware
Affected Vendors
References (2)
42
/ 100
moderate-risk
Severity
21/34 · High
Exploitability
0/34 · Minimal
Exposure
21/34 · High