CVE-2023-22917

Severity CVSS v4.0:
Pending analysis
Type:
CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Publication date:
24/04/2023
Last modified:
04/05/2023

Description

A buffer overflow vulnerability in the “sdwan_iface_ipc” binary of Zyxel ATP series firmware versions 5.10 through 5.32, USG FLEX series firmware versions 5.00 through 5.32, USG FLEX 50(W) firmware versions 5.10 through 5.32, USG20(W)-VPN firmware versions 5.10 through 5.32, and VPN series firmware versions 5.00 through 5.35, which could allow a remote unauthenticated attacker to cause a core dump with a request error message on a vulnerable device by uploading a crafted configuration file.

Vulnerable products and versions

CPE From Up to
cpe:2.3:o:zyxel:usg_flex_100_firmware:*:*:*:*:*:*:*:* 5.00 (including) 5.32 (including)
cpe:2.3:h:zyxel:usg_flex_100:-:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg_flex_100w_firmware:*:*:*:*:*:*:*:* 5.00 (including) 5.32 (including)
cpe:2.3:h:zyxel:usg_flex_100w:-:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg_flex_200_firmware:*:*:*:*:*:*:*:* 5.00 (including) 5.32 (including)
cpe:2.3:h:zyxel:usg_flex_200:-:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg_flex_50_firmware:*:*:*:*:*:*:*:* 5.00 (including) 5.32 (including)
cpe:2.3:h:zyxel:usg_flex_50:-:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg_flex_50w_firmware:*:*:*:*:*:*:*:* 5.10 (including) 5.32 (including)
cpe:2.3:h:zyxel:usg_flex_50w:-:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg_flex_500_firmware:*:*:*:*:*:*:*:* 5.00 (including) 5.32 (including)
cpe:2.3:h:zyxel:usg_flex_500:-:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg_flex_700_firmware:*:*:*:*:*:*:*:* 5.00 (including) 5.32 (including)
cpe:2.3:h:zyxel:usg_flex_700:-:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:vpn100_firmware:*:*:*:*:*:*:*:* 5.00 (including) 5.35 (including)