Strix
26.1K

CVE-2023-6764

HIGHCVSS 8.1/10EPSS 0.89%

Last modified

CVE-2023-6764 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. A format string vulnerability in a function of the IPSec VPN feature in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 through 5.37 Patch 1, and USG20(W)-VPN series firmware versions from 4.16 through 5.37 Patch 1 could allow an attacker to achieve unauthorized remote code execution by sending a sequence of specially crafted payloads containing an invalid pointer; however, such an attack would require detailed knowledge of an affected device’s memory layout and configuration. . EPSS estimates a 0.89% chance of exploitation in the next 30 days.

Description

A format string vulnerability in a function of the IPSec VPN feature in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 through 5.37 Patch 1, and USG20(W)-VPN series firmware versions from 4.16 through 5.37 Patch 1 could allow an attacker to achieve unauthorized remote code execution by sending a sequence of specially crafted payloads containing an invalid pointer; however, such an attack would require detailed knowledge of an affected device’s memory layout and configuration.

Metrics

CVSS 3.1
8.1/10

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
0.89%

54.8th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
ZyxelAtp100 Firmware>= 4.32, < 5.37
ZyxelAtp100 Firmware5.37
ZyxelAtp100w Firmware>= 4.32, < 5.37
ZyxelAtp100w Firmware5.37
ZyxelAtp200 Firmware>= 4.32, < 5.37
ZyxelAtp200 Firmware5.37
ZyxelAtp500 Firmware>= 4.32, < 5.37
ZyxelAtp500 Firmware5.37
ZyxelAtp700 Firmware>= 4.32, < 5.37
ZyxelAtp700 Firmware5.37
ZyxelAtp800 Firmware>= 4.32, < 5.37
ZyxelAtp800 Firmware5.37
ZyxelUsg Flex 100 Firmware>= 4.50, < 5.37
ZyxelUsg Flex 100 Firmware5.37
ZyxelUsg Flex 100ax Firmware>= 4.50, < 5.37
ZyxelUsg Flex 100ax Firmware5.37
ZyxelUsg Flex 100h Firmware>= 4.50, < 5.37
ZyxelUsg Flex 100h Firmware5.37
ZyxelUsg Flex 100w Firmware>= 4.50, < 5.37
ZyxelUsg Flex 100w Firmware5.37
ZyxelUsg Flex 200 Firmware>= 4.50, < 5.37
ZyxelUsg Flex 200 Firmware5.37
ZyxelUsg Flex 200h Firmware>= 4.50, < 5.37
ZyxelUsg Flex 200h Firmware5.37
ZyxelUsg Flex 200hp Firmware>= 4.50, < 5.37
ZyxelUsg Flex 200hp Firmware5.37
ZyxelUsg Flex 500 Firmware>= 4.50, < 5.37
ZyxelUsg Flex 500 Firmware5.37
ZyxelUsg Flex 500h Firmware>= 4.50, < 5.37
ZyxelUsg Flex 500h Firmware5.37
ZyxelUsg Flex 700 Firmware>= 4.50, < 5.37
ZyxelUsg Flex 700 Firmware5.37
ZyxelUsg Flex 700h Firmware>= 4.50, < 5.37
ZyxelUsg Flex 700h Firmware5.37
ZyxelUsg Flex 50 Firmware>= 4.16, < 5.37
ZyxelUsg Flex 50 Firmware5.37
ZyxelUsg Flex 50w Firmware>= 4.16, < 5.37
ZyxelUsg Flex 50w Firmware5.37
ZyxelUsg20-Vpn Firmware>= 4.16, < 5.37
ZyxelUsg20-Vpn Firmware5.37
ZyxelUsg20w-Vpn Firmware>= 4.16, < 5.37
ZyxelUsg20w-Vpn Firmware5.37

References

Timeline

Published
Last Modified
Status
Analyzed

Frequently Asked Questions

What is CVE-2023-6764?
A format string vulnerability in a function of the IPSec VPN feature in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 through 5.37 Patch 1, and USG20(W)-VPN series firmware versions from 4.16 through 5.37 Patch 1 could allow an attacker to achieve unauthorized remote code execution by sending a sequence of specially crafted payloads containing an invalid pointer; however, such an attack would require detailed knowledge of an affected device’s memory layout and configuration.
How severe is CVE-2023-6764?
CVE-2023-6764 has a CVSS score of 8.1/10 (HIGH severity). The EPSS model estimates a 0.89% probability of exploitation in the next 30 days.
How do I fix CVE-2023-6764?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2023

View all 2023CVEs →

Are you affected by CVE-2023-6764?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST