CVE-2023-22917

CWE-120 — Classic Buffer Overflow3 documents3 sources
Severity
7.5HIGH
EPSS
1.3%
top 20.01%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
23
Zyxel Atp100 FirmwareZyxel Atp100w FirmwareZyxel Atp200 Firmware+20 more
Timeline
PublishedApr 24
Latest updateJul 6

Description

A buffer overflow vulnerability in the “sdwan_iface_ipc” binary of Zyxel ATP series firmware versions 5.10 through 5.32, USG FLEX series firmware versions 5.00 through 5.32, USG FLEX 50(W) firmware versions 5.10 through 5.32, USG20(W)-VPN firmware versions 5.10 through 5.32, and VPN series firmware versions 5.00 through 5.35, which could allow a remote unauthenticated attacker to cause a core dump with a request error message on a vulnerable device by uploading a crafted configuration file.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages23 packages

▶CVEListV5zyxel/usg_flex_series_firmware5.00 through 5.32
▶CVEListV5zyxel/atp_series_firmware5.10 through 5.32
▶CVEListV5zyxel/vpn_series_firmware5.00 through 5.35
▶NVDzyxel/usg_flex_50_firmware5.00 — 5.32
▶NVDzyxel/usg_flex_100_firmware5.00 — 5.32

🔴Vulnerability Details

2
GHSA
GHSA-34gf-pfjm-cq2w: A buffer overflow vulnerability in the “sdwan_iface_ipc” binary of Zyxel ATP series firmware versions 5↗2023-07-06
▶
CVEList
CVE-2023-22917: A buffer overflow vulnerability in the “sdwan_iface_ipc” binary of Zyxel ATP series firmware versions 5↗2023-04-24
▶