# CVE-2023-33010

A buffer overflow vulnerability in the ID processing function in Zyxel ATP series firmware versions 4.32 through 5.36 Patch 1, USG FLEX series firmware versions 4.50 through 5.36 Patch 1, USG FLEX 50(W) firmware versions 4.25 through 5.36 Patch 1, USG20(W)-VPN firmware versions 4.25 through 5.36 Patch 1, VPN series firmware versions 4.30 through 5.36 Patch 1, ZyWALL/USG series firmware versions 4.25 through 4.73 Patch 1, could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and even a remote code execution on an affected device.

- Page: https://www.vulneraibility.com/cve/CVE-2023-33010
- CVSS: 9.8
- Known exploited: yes, in CISA KEV since 2023-06-05; CISA due date 2023-06-26
- EPSS: 29.02% (percentile 98.2)
- CISA SSVC: exploitation active, automatable yes, technical impact total (assessed 2025-01-16)
- Weakness: CWE-120
- Published: 2023-05-24

## Affected versions

- Zyxel ATP series firmware: affected 4.32 through 5.36 Patch 1
- Zyxel USG20(W)-VPN firmware: affected 4.25 through 5.36 Patch 1
- Zyxel USG FLEX 50(W) firmware: affected 4.25 through 5.36 Patch 1
- Zyxel USG FLEX series firmware: affected 4.50 through 5.36 Patch 1
- Zyxel VPN series firmware: affected 4.30 through 5.36 Patch 1
- Zyxel ZyWALL/USG series firmware: affected 4.25 through 4.73 Patch 1

A version outside these ranges is not a statement that it is unaffected.

## References

- [other] https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-buffer-overflow-vulnerabilities-of-firewalls
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-33010

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.