CVE-2023-33009
Zyxel Multiple Firewalls Buffer Overflow Vulnerability
Description
CVE-2023-33009 is a critical buffer overflow vulnerability in the notification function of multiple Zyxel firewall products, including the ATP, USG FLEX, VPN, and ZyWALL/USG series. This buffer overflow vulnerability allows an unauthenticated remote attacker to cause denial-of-service conditions or achieve remote code execution on affected Zyxel devices. The flaw affects firmware versions 4.60 through 5.36 Patch 1 across multiple Zyxel product lines, making it a widespread security concern for organizations relying on Zyxel network security appliances. CISA has added CVE-2023-33009 to its Known Exploited Vulnerabilities catalog with a remediation deadline of June 26, 2023, confirming that this Zyxel buffer overflow is being actively exploited in the wild. With an EPSS score of 6.17% (90th percentile), exploitation activity is significant and organizations should prioritize remediation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| zyxel | atp100 firmware | >= 4.60, < 5.36; 5.36 |
| zyxel | atp200 firmware | >= 4.60, < 5.36; 5.36 |
| zyxel | atp500 firmware | >= 4.60, < 5.36; 5.36 |
| zyxel | atp100w firmware | >= 4.60, < 5.36; 5.36 |
| zyxel | atp700 firmware | >= 4.60, < 5.36; 5.36 |
| zyxel | atp800 firmware | >= 4.60, < 5.36; 5.36 |
| zyxel | usg flex 100 firmware | >= 4.60, < 5.36; 5.36 |
| zyxel | usg flex 50 firmware | >= 4.60, < 5.36; 5.36 |
| zyxel | usg flex 200 firmware | >= 4.60, < 5.36; 5.36 |
| zyxel | usg flex 500 firmware | >= 4.60, < 5.36; 5.36 |
| zyxel | usg flex 700 firmware | >= 4.60, < 5.36; 5.36 |
| zyxel | usg flex 100w firmware | >= 4.60, < 5.36; 5.36 |
| zyxel | usg flex 50w firmware | >= 4.60, < 5.36; 5.36 |
| zyxel | usg 20w-vpn firmware | >= 4.60, < 5.36; 5.36 |
| zyxel | vpn100 firmware | >= 4.60, < 5.36; 5.36 |
| zyxel | vpn50 firmware | >= 4.60, < 5.36; 5.36 |
| zyxel | vpn300 firmware | >= 4.60, < 5.36; 5.36 |
| zyxel | vpn1000 firmware | >= 4.60, < 5.36; 5.36 |
| zyxel | usg20-vpn firmware | >= 4.60, < 5.36; 5.36 |
| zyxel | usg 40 firmware | >= 4.60, < 4.73; 4.73 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
Weakness Type
CWE-120: Buffer Copy without Checking Size of Input (Classic Buffer Overflow)
The classic buffer overflow in Zyxel firewall products occurs in the notification function, where input data is copied into a fixed-size buffer without adequate size validation. In the context of CVE-2023-33009, an attacker can send specially crafted requests to the notification function that overflow the allocated buffer, corrupting adjacent memory and potentially allowing remote code execution on the affected Zyxel device.
Learn more: CWE-120 — Buffer Copy without Checking Size of Input
Impact Analysis
CVE-2023-33009 carries a CVSS v3.1 score of 9.8 (Critical), reflecting the maximum severity for this Zyxel buffer overflow vulnerability. The vulnerability is remotely exploitable without physical access over the network, requires no authentication and no user interaction, and is easy to exploit with no special conditions needed. Confidentiality (High): Successful exploitation can expose sensitive configuration data, VPN credentials, firewall rules, and internal network information stored on the Zyxel appliance. Integrity (High): An attacker achieving remote code execution can modify firewall rules, disable security policies, create backdoor accounts, and alter device configurations to facilitate further attacks on the internal network. Availability (High): The buffer overflow can crash the Zyxel firewall service or render the device completely inoperable, disrupting network connectivity and security protections for all traffic passing through the appliance. With an EPSS score of 6.17% in the 90th percentile, exploitation activity is confirmed and organizations running affected Zyxel firmware should treat this as a high-priority security event.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2023-33009 in the wild by adding it to the Known Exploited Vulnerabilities catalog with a remediation deadline of June 26, 2023, though the ransomware association is currently unknown. The EPSS score of 6.17% (90th percentile) indicates meaningful exploitation activity, placing this vulnerability among the more actively targeted flaws. While no public exploit code tagged as "Exploit" appears in the available references, the confirmed active exploitation status from CISA indicates that working exploits are being used by threat actors against Zyxel firewall deployments. Organizations running affected Zyxel firmware versions should act immediately given the confirmed in-the-wild exploitation.
Remediation
-
Apply Zyxel firmware patches immediately as directed by CISA: "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable." Upgrade all affected Zyxel devices to firmware versions beyond 5.36 Patch 1 for ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, and VPN series, and beyond 4.73 Patch 1 for ZyWALL/USG series. Consult the Zyxel security advisory for specific patched firmware versions.
-
Restrict management interface access by disabling remote management access from the WAN side and limiting administrative access to trusted internal IP addresses only. Configure access control lists (ACLs) on the Zyxel device to block untrusted sources from reaching the notification function endpoint.
-
Implement network segmentation by placing Zyxel firewalls behind an additional perimeter security layer if possible. Deploy a web application firewall or intrusion prevention system in front of the Zyxel device that can detect and block buffer overflow exploitation attempts targeting the notification function.
-
Review device logs for indicators of compromise on all affected Zyxel appliances. Look for unusual crash reports, unexpected reboots, unauthorized configuration changes, or anomalous network traffic patterns. Reset all administrative credentials and VPN user passwords as a precautionary measure.
-
Enable automatic firmware update notifications on Zyxel devices and establish a regular patch management cycle for network security appliances. Implement input validation and size-checking mechanisms through available device hardening options to reduce exposure to future buffer overflow vulnerabilities.
Technical Details
CVE-2023-33009 is a classic buffer overflow vulnerability (CWE-120) in the notification function of Zyxel firewall firmware. The vulnerability occurs because the notification function copies input data into a fixed-size buffer without properly validating the size of the input, allowing an attacker to write beyond the buffer boundaries and corrupt adjacent memory. As reflected in the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the attack is accessible over the network with low complexity, requires no authentication or user interaction, and impacts all three security properties at the highest level. The buffer overflow in the notification function can be triggered by sending crafted requests to the affected Zyxel device, and the lack of proper bounds checking enables an unauthenticated attacker to overwrite return addresses or function pointers on the stack or heap, redirecting execution flow to attacker-controlled code. This vulnerability affects the firmware across multiple Zyxel product lines (ATP, USG FLEX, VPN, ZyWALL/USG series) because they share the same vulnerable notification function codebase.
Frequently Asked Questions
Is CVE-2023-33009 being actively exploited?
Yes, CVE-2023-33009 is being actively exploited in the wild. CISA has confirmed active exploitation by adding this vulnerability to the Known Exploited Vulnerabilities catalog with a remediation deadline of June 26, 2023. The EPSS score of 6.17% (90th percentile) indicates significant exploitation activity against affected Zyxel firewall products.
What products are affected by CVE-2023-33009?
CVE-2023-33009 affects a wide range of Zyxel firewall products including the ATP series (ATP100, ATP200, ATP500, ATP700, ATP800), USG FLEX series (50, 100, 200, 500, 700), USG FLEX 50(W), USG20(W)-VPN, VPN series (VPN50, VPN100, VPN300, VPN1000), and ZyWALL/USG series (USG 40). Affected firmware versions range from 4.60 through 5.36 Patch 1 for most products, and 4.60 through 4.73 Patch 1 for ZyWALL/USG.
How do I fix CVE-2023-33009?
Upgrade the firmware on all affected Zyxel devices to versions beyond 5.36 Patch 1 (or 4.73 Patch 1 for ZyWALL/USG). Consult the official Zyxel security advisory for specific patched firmware versions for each product line. As an interim measure, restrict WAN-side management access and limit connectivity to trusted IP addresses only.
How severe is CVE-2023-33009?
CVE-2023-33009 is rated Critical with a CVSS v3.1 score of 9.8 out of 10. It requires no authentication, no user interaction, and can be exploited remotely with low complexity. The vulnerability sits in the 90th percentile for exploitation probability, and CISA has confirmed active exploitation in the wild.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.