CVE-2023-4398

CWE-190 — Integer Overflow6 documents6 sources

Severity

7.5HIGH

EPSS

0.2%

top 58.73%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Zyxel ZLD Zyxel ATP Series Firmware Zyxel Usg20(w)-vpn Series Firmware +3 more

Timeline

PublishedNov 28

Latest updateDec 24

Description

An integer overflow vulnerability in the source code of the QuickSec IPSec toolkit used in the VPN feature of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50(W) series firmware versions 4.16 through 5.37, USG20(W)-VPN series firmware versions 4.16 through 5.37, and VPN series firmware versions 4.30 through 5.37, could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions on an affected device by se…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages6 packages

▶CVEListV5zyxel/usg_flex_series_firmwareversions 4.50 through 5.37

▶CVEListV5zyxel/usg_flex_50(w)_series_firmwareversions 4.16 through 5.37

▶CVEListV5zyxel/usg20(w)-vpn_series_firmwareversions 4.16 through 5.37

▶CVEListV5zyxel/atp_series_firmwareversions 4.32 through 5.37

▶CVEListV5zyxel/vpn_series_firmwareversions 4.30 through 5.37

🔴Vulnerability Details

OSV

erofs: stop parsing non-compact HEAD index if clusterofs is invalid↗2025-12-24

▶

GHSA

GHSA-rfqw-q592-fp2h: An integer overflow vulnerability in the source code of the QuickSec IPSec toolkit used in the VPN feature of the Zyxel ATP series firmware versions 4↗2023-11-28

▶

CVEList

CVE-2023-4398: An integer overflow vulnerability in the source code of the QuickSec IPSec toolkit used in the VPN feature of the Zyxel ATP series firmware versions 4↗2023-11-28

▶

📋Vendor Advisories

Red Hat

kernel: erofs: stop parsing non-compact HEAD index if clusterofs is invalid↗2025-12-24

▶