CVE-2023-22917
Severity CVSS v4.0:
Pending analysis
Type:
CWE-120
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Publication date:
24/04/2023
Last modified:
04/05/2023
Description
A buffer overflow vulnerability in the “sdwan_iface_ipc” binary of Zyxel ATP series firmware versions 5.10 through 5.32, USG FLEX series firmware versions 5.00 through 5.32, USG FLEX 50(W) firmware versions 5.10 through 5.32, USG20(W)-VPN firmware versions 5.10 through 5.32, and VPN series firmware versions 5.00 through 5.35, which could allow a remote unauthenticated attacker to cause a core dump with a request error message on a vulnerable device by uploading a crafted configuration file.
Impact
Base Score 3.x
7.50
Severity 3.x
HIGH
Vulnerable products and versions
CPE | From | Up to |
---|---|---|
cpe:2.3:o:zyxel:usg_flex_100_firmware:*:*:*:*:*:*:*:* | 5.00 (including) | 5.32 (including) |
cpe:2.3:h:zyxel:usg_flex_100:-:*:*:*:*:*:*:* | ||
cpe:2.3:o:zyxel:usg_flex_100w_firmware:*:*:*:*:*:*:*:* | 5.00 (including) | 5.32 (including) |
cpe:2.3:h:zyxel:usg_flex_100w:-:*:*:*:*:*:*:* | ||
cpe:2.3:o:zyxel:usg_flex_200_firmware:*:*:*:*:*:*:*:* | 5.00 (including) | 5.32 (including) |
cpe:2.3:h:zyxel:usg_flex_200:-:*:*:*:*:*:*:* | ||
cpe:2.3:o:zyxel:usg_flex_50_firmware:*:*:*:*:*:*:*:* | 5.00 (including) | 5.32 (including) |
cpe:2.3:h:zyxel:usg_flex_50:-:*:*:*:*:*:*:* | ||
cpe:2.3:o:zyxel:usg_flex_50w_firmware:*:*:*:*:*:*:*:* | 5.10 (including) | 5.32 (including) |
cpe:2.3:h:zyxel:usg_flex_50w:-:*:*:*:*:*:*:* | ||
cpe:2.3:o:zyxel:usg_flex_500_firmware:*:*:*:*:*:*:*:* | 5.00 (including) | 5.32 (including) |
cpe:2.3:h:zyxel:usg_flex_500:-:*:*:*:*:*:*:* | ||
cpe:2.3:o:zyxel:usg_flex_700_firmware:*:*:*:*:*:*:*:* | 5.00 (including) | 5.32 (including) |
cpe:2.3:h:zyxel:usg_flex_700:-:*:*:*:*:*:*:* | ||
cpe:2.3:o:zyxel:vpn100_firmware:*:*:*:*:*:*:*:* | 5.00 (including) | 5.35 (including) |
To consult the complete list of CPE names with products and versions, see this page