CVE-2023-6397 — NULL Pointer Dereference in Zyxel Atp100 Firmware

CWE-476 — NULL Pointer Dereference3 documents3 sources
Severity
5.3MEDIUMNVD
CNA6.5
EPSS
0.1%
top 67.59%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
21
Zyxel Atp100 FirmwareZyxel Atp100w FirmwareZyxel Atp200 Firmware+18 more
Timeline
PublishedFeb 20

Description

A null pointer dereference vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1 and USG FLEX series firmware versions from 4.50 through 5.37 Patch 1 could allow a LAN-based attacker to cause denial-of-service (DoS) conditions by downloading a crafted RAR compressed file onto a LAN-side host if the firewall has the “Anti-Malware” feature enabled.

CVSS vector

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 1.6 | Impact: 3.6

Affected Packages21 packages

▶CVEListV5zyxel/usg_flex_series_firmwareversion 4.50 through 5.37 Patch 1
▶CVEListV5zyxel/atp_series_firmwareversion 4.32 through 5.37 Patch 1
▶NVDzyxel/usg_flex_50_firmware4.50 — 5.37+1
▶NVDzyxel/usg_flex_100_firmware4.50 — 5.37+1
▶NVDzyxel/usg_flex_200_firmware4.50 — 5.37+1

🔴Vulnerability Details

2
GHSA
GHSA-wj52-rfj4-xjcm: A null pointer dereference vulnerability in Zyxel ATP series firmware versions from 4↗2024-02-20
▶
CVEList
CVE-2023-6397: A null pointer dereference vulnerability in Zyxel ATP series firmware versions from 4↗2024-02-20
▶
CVE-2023-6397 — NULL Pointer Dereference in Zyxel | cvebase