CVE-2023-4398
Last modified
CVE-2023-4398 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. An integer overflow vulnerability in the source code of the QuickSec IPSec toolkit used in the VPN feature of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50(W) series firmware versions 4.16 through 5.37, USG20(W)-VPN series firmware versions 4.16 through 5.37, and VPN series firmware versions 4.30 through 5.37, could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions on an affected device by sending a crafted IKE packet.. EPSS estimates a 0.88% chance of exploitation in the next 30 days.
Description
An integer overflow vulnerability in the source code of the QuickSec IPSec toolkit used in the VPN feature of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50(W) series firmware versions 4.16 through 5.37, USG20(W)-VPN series firmware versions 4.16 through 5.37, and VPN series firmware versions 4.30 through 5.37, could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions on an affected device by sending a crafted IKE packet.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Zyxel | Zld | >= 4.32, <= 5.37 |
| Zyxel | Zld | >= 4.50, <= 5.37 |
| Zyxel | Zld | >= 4.16, <= 5.37 |
| Zyxel | Zld | >= 4.30, <= 5.37 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-4398?
How severe is CVE-2023-4398?
How do I fix CVE-2023-4398?
Are you affected by CVE-2023-4398?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST