VulnerabilityModified

CVE-2023-34140

MEDIUM 6.5EPSS 0.30%

Does this matter?

Lower severity and a low EPSS score (0.30%). Track it; it rarely justifies an emergency change on its own.

Description

A buffer overflow vulnerability in the Zyxel ATP series firmware versions 4.32 through 5.36 Patch 2, USG FLEX series firmware versions 4.50 through 5.36 Patch 2, USG FLEX 50(W) series firmware versions 4.16 through 5.36 Patch 2, USG20(W)-VPN series firmware versions 4.16 through 5.36 Patch 2, VPN series firmware versions 4.30 through 5.36 Patch 2, NXC2500 firmware versions 6.10(AAIG.0) through 6.10(AAIG.3), and NXC5500 firmware versions 6.10(AAOS.0) through 6.10(AAOS.4), could allow an unauthenticated, LAN-based attacker to cause denial of service (DoS) conditions by sending a crafted request to the CAPWAP daemon.

CVSS 3.1: 6.5 MEDIUMCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS: 0.30% probability · 23th percentile
CISA KEV: Not listed
Weakness: CWE-120
Affected: zyxel/usg 20w-vpn firmware · zyxel/usg 2200-vpn firmware · zyxel/usg flex 100 firmware · zyxel/usg flex 100w firmware · zyxel/usg flex 200 firmware · zyxel/usg flex 50 firmware · zyxel/usg flex 500 firmware · zyxel/usg flex 50w firmware · zyxel/usg flex 700 firmware · zyxel/zywall atp100 firmware · zyxel/zywall atp100w firmware · zyxel/zywall atp200 firmware · zyxel/zywall atp500 firmware · zyxel/zywall atp700 firmware · zyxel/zywall atp800 firmware · zyxel/zywall vpn100 firmware · zyxel/zywall vpn2s firmware · zyxel/zywall vpn300 firmware · zyxel/zywall vpn50 firmware · zyxel/zywall vpn 100 firmware · +4 more
Source: security@zyxel.com.tw

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.