CVE-2023-6397

published 2024-02-20

CVE-2023-6397: A null pointer dereference vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1 and USG FLEX series firmware versions from 4.50…

Priority P4 21 medium 5.3 CVSS 3.1

AV A AC H PR N UI N S U C N I N A H

A null pointer dereference vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1 and USG FLEX series firmware versions from 4.50 through 5.37 Patch 1 could allow a LAN-based attacker to cause denial-of-service (DoS) conditions by downloading a crafted RAR compressed file onto a LAN-side host if the firewall has the “Anti-Malware” feature enabled.

Affected

40 ranges · showing 25

Vendor	Product	Version range	Fixed in
zyxel	atp100_firmware	—	—
zyxel	atp100_firmware	>= 4.32 < 5.37	5.37
zyxel	atp100w_firmware	—	—
zyxel	atp100w_firmware	>= 4.32 < 5.37	5.37
zyxel	atp200_firmware	—	—
zyxel	atp200_firmware	>= 4.32 < 5.37	5.37
zyxel	atp500_firmware	—	—
zyxel	atp500_firmware	>= 4.32 < 5.37	5.37
zyxel	atp700_firmware	—	—
zyxel	atp700_firmware	>= 4.32 < 5.37	5.37
zyxel	atp800_firmware	—	—
zyxel	atp800_firmware	>= 4.32 < 5.37	5.37
zyxel	atp_series_firmware	—	—
zyxel	usg_flex_100_firmware	—	—
zyxel	usg_flex_100_firmware	>= 4.50 < 5.37	5.37
zyxel	usg_flex_100ax_firmware	—	—
zyxel	usg_flex_100ax_firmware	>= 4.50 < 5.37	5.37
zyxel	usg_flex_100h_firmware	—	—
zyxel	usg_flex_100h_firmware	>= 4.50 < 5.37	5.37
zyxel	usg_flex_100w_firmware	—	—
zyxel	usg_flex_100w_firmware	>= 4.50 < 5.37	5.37
zyxel	usg_flex_200_firmware	—	—
zyxel	usg_flex_200_firmware	>= 4.50 < 5.37	5.37
zyxel	usg_flex_200h_firmware	—	—
zyxel	usg_flex_200h_firmware	>= 4.50 < 5.37	5.37

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-476