CVE-2023-33009
Critical 9.8 Exploited in the wild (KEV)
Confirmed active exploitation — CISA KEV catalog
- Name
- Zyxel Multiple Firewalls Buffer Overflow Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply updates per vendor instructions.
Description
A buffer overflow vulnerability in the notification function in Zyxel ATP series firmware versions 4.60 through 5.36 Patch 1, USG FLEX series firmware versions 4.60 through 5.36 Patch 1, USG FLEX 50(W) firmware versions 4.60 through 5.36 Patch 1, USG20(W)-VPN firmware versions 4.60 through 5.36 Patch 1, VPN series firmware versions 4.60 through 5.36 Patch 1, ZyWALL/USG series firmware versions 4.60 through 4.73 Patch 1, could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and even a remote code execution on an affected device.
Metrics
- CVSS 3.1
-
9.8 (CRITICAL)
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 28% (percentile: 98) as of 2 November 2026
- CWE
- CWE-120
Affected products
zyxel: atp100 firmware; zyxel: atp100; zyxel: atp200 firmware; zyxel: atp200; zyxel: atp500 firmware; zyxel: atp500; zyxel: atp100w firmware; zyxel: atp100w; zyxel: atp700 firmware; zyxel: atp700; zyxel: atp800 firmware; zyxel: atp800; zyxel: usg flex 100 firmware; zyxel: usg flex 100; zyxel: usg flex 50 firmware