{"id":"CVE-2023-33010","url":"https://www.cyber-defence.io/tools/cve/CVE-2023-33010","generatedAt":"2026-10-31T11:45:25.212Z","title":"Zyxel Multiple Firewalls Buffer Overflow Vulnerability","description":"A buffer overflow vulnerability in the ID processing function in Zyxel ATP series firmware versions 4.32 through 5.36 Patch 1, USG FLEX series firmware versions 4.50 through 5.36 Patch 1, USG FLEX 50(W) firmware versions 4.25 through 5.36 Patch 1, USG20(W)-VPN firmware versions 4.25 through 5.36 Patch 1, VPN series firmware versions 4.30 through 5.36 Patch 1, ZyWALL/USG series firmware versions 4.25 through 4.73 Patch 1, could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and even a remote code execution on an affected device.","published":"2023-05-24T13:15:10.000Z","lastModified":"2026-06-17T06:00:17.000Z","status":"Analyzed","sourceIdentifier":"security@zyxel.com.tw","cvss":{"version":"3.1","score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-120"],"affected":["zyxel/atp100 firmware","zyxel/atp200 firmware","zyxel/atp500 firmware","zyxel/atp100w firmware","zyxel/atp700 firmware","zyxel/atp800 firmware","zyxel/usg flex 100 firmware","zyxel/usg flex 50 firmware","zyxel/usg flex 200 firmware","zyxel/usg flex 500 firmware","zyxel/usg flex 700 firmware","zyxel/usg flex 100w firmware","zyxel/usg flex 50w firmware","zyxel/usg 20w-vpn firmware","zyxel/vpn100 firmware","zyxel/vpn50 firmware","zyxel/vpn300 firmware","zyxel/vpn1000 firmware","zyxel/usg20-vpn firmware","zyxel/usg 40 firmware","zyxel/usg 40w firmware","zyxel/usg 60w firmware","zyxel/usg 60 firmware"],"epss":{"score":0.29024,"percentile":0.98157,"date":"2026-10-30","history":[]},"kev":{"listed":true,"dateAdded":"2023-06-05","dueDate":"2023-06-26","knownRansomwareCampaignUse":"Unknown","notes":"Apply updates per vendor instructions.\nhttps://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-buffer-overflow-vulnerabilities-of-firewalls;  https://nvd.nist.gov/vuln/detail/CVE-2023-33010"},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"urgent","text":"Known to be exploited in the wild (CISA KEV, CISA remediation deadline 26 June 2023). Treat as an emergency change: patch or isolate now, then hunt for prior compromise."},"changes":[],"references":[{"url":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-buffer-overflow-vulnerabilities-of-firewalls","tags":["Vendor Advisory"],"source":"security@zyxel.com.tw"},{"url":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-buffer-overflow-vulnerabilities-of-firewalls","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-33010","tags":["US Government Resource"],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2023-33010","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}