CVE-2023-33009
A buffer overflow vulnerability in the notification function in Zyxel ATP series firmware...
A buffer overflow vulnerability in the notification function in Zyxel ATP series firmware versions 4.60 through 5.36 Patch 1, USG FLEX series firmware versions 4.60 through 5.36 Patch 1, USG FLEX 50(W) firmware versions 4.60 through 5.36 Patch 1, USG20(W)-VPN firmware versions 4.60 through 5.36 Patch 1, VPN series firmware versions 4.60 through 5.36 Patch 1, ZyWALL/USG series firmware versions 4.60 through 4.73 Patch 1, could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and even a remote code execution on an affected device.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
A buffer overflow vulnerability in the notification function in Zyxel ATP series firmware versions 4.60 through 5.36 Patch 1, USG FLEX series firmware versions 4.60 through 5.36 Patch 1, USG FLEX 50(W) firmware versions 4.60 through 5.36 Patch 1, USG20(W)-VPN firmware versions 4.60 through 5.36 Patch 1, VPN series firmware versions 4.60 through 5.36 Patch 1, ZyWALL/USG series firmware versions 4.60 through 4.73 Patch 1, could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and even a remote code execution on an affected device.
- Record
CVE-2023-33009- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-120
- Updated
- 2026-11-02
EUVDEUVD-2023-37198
A buffer overflow vulnerability in the notification function in Zyxel ATP series firmware versions 4.60 through 5.36 Patch 1, USG FLEX series firmware versions 4.60 through 5.36 Patch 1, USG FLEX 50(W) firmware versions 4.60 through 5.36 Patch 1, USG20(W)-VPN firmware versions 4.60 through 5.36 Patch 1, VPN series firmware versions 4.60 through 5.36 Patch 1, ZyWALL/USG series firmware versions 4.60 through 4.73 Patch 1, could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and even a remote code execution on an affected device.
- Record
EUVD-2023-37198- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-g3f9-6h7x-x69v
A buffer overflow vulnerability in the notification function in Zyxel ATP series firmware...
A buffer overflow vulnerability in the notification function in Zyxel ATP series firmware versions 4.32 through 5.36 Patch 1, USG FLEX series firmware versions 4.50 through 5.36 Patch 1, USG FLEX 50(W) firmware versions 4.25 through 5.36 Patch 1, USG20(W)-VPN firmware versions 4.25 through 5.36 Patch 1, VPN series firmware versions 4.30 through 5.36 Patch 1, ZyWALL/USG series firmware versions 4.25 through 4.73 Patch 1, could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and even a remote code execution on an affected device.
- Record
GHSA-g3f9-6h7x-x69v- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-120
- Updated
- 2026-11-02
CISA KEV No score
Zyxel Multiple Firewalls Buffer Overflow Vulnerability
Zyxel ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN, and ZyWALL/USG firewalls contain a buffer overflow vulnerability in the notification function that could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and remote code execution on an affected device.
- Record
CVE-2023-33009- Weakness
- CWE-120
- Updated
- 2026-11-02
NVD
A buffer overflow vulnerability in the notification function in Zyxel ATP series firmware versions 4.60 through 5.36 Patch 1, USG FLEX series firmware versions 4.60 through 5.36 Patch 1, USG FLEX 50(W) firmware versions 4.60 through 5.36 Patch 1, USG20(W)-VPN firmware versions 4.60 through 5.36 Patch 1, VPN series firmware versions 4.60 through 5.36 Patch 1, ZyWALL/USG series firmware versions 4.60 through 4.73 Patch 1, could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and even a remote code execution on an affected device.
- Record
CVE-2023-33009- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-120
- Updated
- 2026-11-02
Affected products
- zyxel atp series firmware
- zyxel usg flex 50(w) firmware
- zyxel usg flex series firmware
- zyxel usg20(w)-vpn firmware
- zyxel vpn series firmware
- zyxel zywall/usg series firmware
- zyxel atp100 firmware
- zyxel atp100w firmware
- zyxel atp200 firmware
- zyxel atp500 firmware
- zyxel atp700 firmware
- zyxel atp800 firmware
Show 18 moreShow less
- zyxel multiple firewalls
- zyxel usg20-vpn firmware
- zyxel usg 20w-vpn firmware
- zyxel usg 40 firmware
- zyxel usg 40w firmware
- zyxel usg 60 firmware
- zyxel usg 60w firmware
- zyxel usg flex 100 firmware
- zyxel usg flex 100w firmware
- zyxel usg flex 200 firmware
- zyxel usg flex 500 firmware
- zyxel usg flex 50 firmware
- zyxel usg flex 50w firmware
- zyxel usg flex 700 firmware
- zyxel vpn1000 firmware
- zyxel vpn100 firmware
- zyxel vpn300 firmware
- zyxel vpn50 firmware
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation | ||
| first indexed | CVE List, EUVD, GitHub Advisories, CISA KEV, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-33009 is a critical vulnerability (CVSS 9.8) in Zyxel Atp Series Firmware, published May 24, 2023. CISA lists it as known to be exploited, since June 5, 2023. EUVD reports exploitation since June 5, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 28.1%, the 98th percentile. No source names a fixed version.