CVE-2023-33010
Zyxel Multiple Firewalls Buffer Overflow Vulnerability
Description
CVE-2023-33010 is a critical buffer overflow vulnerability in the ID processing function of multiple Zyxel firewall products, including the ATP, USG FLEX, VPN, and ZyWALL/USG series. This buffer overflow security flaw allows an unauthenticated remote attacker to cause denial-of-service conditions or execute arbitrary code on affected Zyxel devices. The vulnerability impacts a broad range of firmware versions across Zyxel product lines, with affected versions spanning from 4.25 (or 4.32/4.50 depending on the series) through 5.36 Patch 1. CISA has added CVE-2023-33010 to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild with a remediation deadline of June 26, 2023. With an EPSS score of 5.85% placing it in the 90th percentile, this Zyxel buffer overflow vulnerability demands prompt remediation across all affected deployments.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| zyxel | atp100 firmware | >= 4.32, < 5.36; 5.36 |
| zyxel | atp200 firmware | >= 4.32, < 5.36; 5.36 |
| zyxel | atp500 firmware | >= 4.32, < 5.36; 5.36 |
| zyxel | atp100w firmware | >= 4.32, < 5.36; 5.36 |
| zyxel | atp700 firmware | >= 4.32, < 5.36; 5.36 |
| zyxel | atp800 firmware | >= 4.32, < 5.36; 5.36 |
| zyxel | usg flex 100 firmware | >= 4.50, < 5.36; 5.36 |
| zyxel | usg flex 50 firmware | 5.36 |
| zyxel | usg flex 200 firmware | >= 4.50, < 5.36; 5.36 |
| zyxel | usg flex 500 firmware | >= 4.50, < 5.36; 5.36 |
| zyxel | usg flex 700 firmware | >= 4.50, < 5.36; 5.36 |
| zyxel | usg flex 100w firmware | 5.36 |
| zyxel | usg flex 50w firmware | >= 4.25, < 5.36; 5.36 |
| zyxel | usg 20w-vpn firmware | 5.36 |
| zyxel | vpn100 firmware | >= 4.30, < 5.36; 5.36 |
| zyxel | vpn50 firmware | >= 4.30, < 5.36; 5.36 |
| zyxel | vpn300 firmware | >= 4.30, < 5.36; 5.36 |
| zyxel | vpn1000 firmware | >= 4.30, < 5.36; 5.36 |
| zyxel | usg20-vpn firmware | >= 4.30, < 5.36; 5.36 |
| zyxel | usg 40 firmware | >= 4.25, < 4.73; 4.73 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
Weakness Type
CWE-120: Buffer Copy without Checking Size of Input (Classic Buffer Overflow)
The classic buffer overflow in Zyxel firewall products occurs in the ID processing function, where input data is copied into a buffer without proper validation of the input size. In the context of CVE-2023-33010, an attacker can exploit this weakness by sending crafted data to the ID processing function, causing the buffer to overflow and potentially overwriting adjacent memory to achieve denial of service or remote code execution on the affected Zyxel device.
Learn more: CWE-120 — Buffer Copy without Checking Size of Input
Impact Analysis
CVE-2023-33010 carries a CVSS v3.1 score of 9.8 (Critical), representing the maximum severity classification for this Zyxel buffer overflow vulnerability. The vulnerability is remotely exploitable without physical access over the network, requires no authentication and no user interaction, and is easy to exploit with no special conditions needed. Confidentiality (High): Successful exploitation can expose sensitive data stored on the Zyxel firewall, including VPN credentials, network configurations, routing tables, and internal traffic logs. Integrity (High): Remote code execution enables an attacker to modify firewall policies, inject malicious rules, create unauthorized administrative accounts, and compromise the security posture of the entire network perimeter. Availability (High): The buffer overflow can crash the Zyxel device or allow an attacker to render the firewall inoperative, disrupting all network traffic and security functions that depend on the appliance. With an EPSS score of 5.85% in the 90th percentile, exploitation activity is confirmed and organizations should treat this as a critical-priority remediation effort.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2023-33010 in the wild by adding it to the Known Exploited Vulnerabilities catalog with a remediation deadline of June 26, 2023, though the ransomware association is currently unknown. The EPSS score of 5.85% (90th percentile) indicates meaningful exploitation activity against affected Zyxel devices. While no public exploit code tagged as "Exploit" appears in the available references, the confirmed active exploitation status demonstrates that threat actors have developed and are using working exploits against Zyxel firewall deployments. This vulnerability is commonly associated with its sibling CVE-2023-33009 (a buffer overflow in the notification function), and organizations should ensure both vulnerabilities are patched simultaneously.
Remediation
-
Apply Zyxel firmware patches immediately as directed by CISA: "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable." Upgrade all affected Zyxel devices to firmware versions beyond 5.36 Patch 1 for ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, and VPN series, and beyond 4.73 Patch 1 for ZyWALL/USG series. Consult the Zyxel security advisory for specific patched firmware versions per product.
-
Restrict access to the management interface by disabling remote administration from the WAN side and configuring access control lists to permit only trusted internal IP addresses. Ensure the ID processing function endpoint is not accessible from untrusted network segments.
-
Deploy network-level protections by placing an intrusion prevention system or additional firewall in front of affected Zyxel devices to detect and block buffer overflow exploitation attempts. Implement rate limiting and deep packet inspection on traffic destined for Zyxel management interfaces.
-
Audit device logs and check for compromise indicators on all affected Zyxel appliances. Look for unexpected device reboots, unauthorized configuration changes, new administrative accounts, or unusual outbound connections. Reset all administrative and VPN credentials as a precautionary measure.
-
Establish a dedicated patch management process for network security appliances. Enable firmware update notifications on all Zyxel devices and ensure both CVE-2023-33010 and the related CVE-2023-33009 are addressed simultaneously. Consider implementing network-level input validation and access controls as defense-in-depth measures against future buffer overflow vulnerabilities.
Technical Details
CVE-2023-33010 is a classic buffer overflow vulnerability (CWE-120) in the ID processing function of Zyxel firewall firmware. The flaw arises because the ID processing function copies user-supplied input into a fixed-size buffer without properly checking the length of the incoming data, allowing an attacker to overwrite adjacent memory regions. As indicated by the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), this vulnerability is accessible over the network with low complexity and requires no authentication or user interaction, while impacting confidentiality, integrity, and availability at the highest level. The buffer overflow in the ID processing function differs from the related CVE-2023-33009 (which affects the notification function) but shares the same root cause of insufficient input size validation. By sending specially crafted data to the ID processing function, an unauthenticated attacker can corrupt stack or heap memory structures, overwrite critical control data such as return addresses, and redirect program execution to achieve remote code execution with the privileges of the firewall process.
Frequently Asked Questions
Is CVE-2023-33010 being actively exploited?
Yes, CVE-2023-33010 is being actively exploited in the wild. CISA has confirmed active exploitation by including this vulnerability in the Known Exploited Vulnerabilities catalog with a remediation deadline of June 26, 2023. The EPSS score of 5.85% (90th percentile) further indicates significant exploitation activity targeting affected Zyxel firewall products.
What products are affected by CVE-2023-33010?
CVE-2023-33010 affects Zyxel ATP series (ATP100, ATP200, ATP500, ATP700, ATP800), USG FLEX series (50, 100, 200, 500, 700), USG FLEX 50(W), USG20(W)-VPN, VPN series (VPN50, VPN100, VPN300, VPN1000), and ZyWALL/USG series (USG 40). Affected firmware versions vary by product but generally span from versions 4.25-4.50 through 5.36 Patch 1, with ZyWALL/USG affected through 4.73 Patch 1.
How do I fix CVE-2023-33010?
Upgrade firmware on all affected Zyxel devices to versions beyond 5.36 Patch 1 (or beyond 4.73 Patch 1 for ZyWALL/USG). Check the official Zyxel security advisory for specific patched firmware versions per product. Also ensure the related CVE-2023-33009 is patched simultaneously, and restrict WAN-side management access as an interim mitigation.
How severe is CVE-2023-33010?
CVE-2023-33010 is rated Critical with a CVSS v3.1 score of 9.8 out of 10. The vulnerability requires no authentication or user interaction, can be exploited remotely with low complexity, and enables both denial of service and remote code execution. Its EPSS score places it in the 90th percentile for exploitation probability, confirming active targeting by threat actors.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.