CVE-2023-34140 : A buffer overflow vulnerability in the Zyxel ATP series firmware versions 4.32 t

A buffer overflow vulnerability in the Zyxel ATP series firmware versions 4.32 through 5.36 Patch 2, USG FLEX series firmware versions 4.50 through 5.36 Patch 2, USG FLEX 50(W) series firmware versions 4.16 through 5.36 Patch 2, USG20(W)-VPN series firmware versions 4.16 through 5.36 Patch 2, VPN series firmware versions 4.30 through 5.36 Patch 2, NXC2500 firmware versions 6.10(AAIG.0) through 6.10(AAIG.3), and NXC5500 firmware versions 6.10(AAOS.0) through 6.10(AAOS.4), could allow an unauthenticated, LAN-based attacker to cause denial of service (DoS) conditions by sending a crafted request to the CAPWAP daemon.

Published 2023-07-17 18:15:10

Updated 2023-07-26 21:29:58

Source Zyxel Corporation

View at NVD, CVE.org

Vulnerability category: OverflowDenial of service

Products affected by CVE-2023-34140

Zyxel » Zywall Vpn 50 Firmware
Versions from including (>=) 4.30 and before (<) 5.37
cpe:2.3:o:zyxel:zywall_vpn_50_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Zywall Vpn 50 » Version: N/A
Zyxel » Zywall Vpn 100 Firmware
Versions from including (>=) 4.30 and before (<) 5.37
cpe:2.3:o:zyxel:zywall_vpn_100_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Zywall Vpn 100 » Version: N/A
Zyxel » Zywall Vpn 300 Firmware
Versions from including (>=) 4.30 and before (<) 5.37
cpe:2.3:o:zyxel:zywall_vpn_300_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Zywall Vpn 300 » Version: N/A
Zyxel » Usg 2200-vpn Firmware
Versions from including (>=) 4.30 and before (<) 5.37
cpe:2.3:o:zyxel:usg_2200-vpn_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg 2200-vpn » Version: N/A
Zyxel » Usg 20w-vpn Firmware
Versions from including (>=) 4.16 and before (<) 5.37
cpe:2.3:o:zyxel:usg_20w-vpn_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg 20w-vpn » Version: N/A
Zyxel » Zywall Vpn100 Firmware
Versions from including (>=) 4.30 and before (<) 5.37
cpe:2.3:o:zyxel:zywall_vpn100_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Zywall Vpn100 » Version: N/A
Zyxel » Zywall Vpn300 Firmware
Versions from including (>=) 4.30 and before (<) 5.37
cpe:2.3:o:zyxel:zywall_vpn300_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Zywall Vpn300 » Version: N/A
Zyxel » Usg Flex 100 Firmware
Versions from including (>=) 4.50 and before (<) 5.37
cpe:2.3:o:zyxel:usg_flex_100_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg Flex 100 » Version: N/A
Zyxel » Usg Flex 200 Firmware
Versions from including (>=) 4.50 and before (<) 5.37
cpe:2.3:o:zyxel:usg_flex_200_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg Flex 200 » Version: N/A
Zyxel » Usg Flex 500 Firmware
Versions from including (>=) 4.50 and before (<) 5.37
cpe:2.3:o:zyxel:usg_flex_500_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg Flex 500 » Version: N/A
Zyxel » Usg Flex 100w Firmware
Versions from including (>=) 4.50 and before (<) 5.37
cpe:2.3:o:zyxel:usg_flex_100w_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg Flex 100w » Version: N/A
Zyxel » Usg Flex 700 Firmware
Versions from including (>=) 4.50 and before (<) 5.37
cpe:2.3:o:zyxel:usg_flex_700_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg Flex 700 » Version: N/A
Zyxel » Zywall Atp100 Firmware
Versions from including (>=) 4.32 and before (<) 5.37
cpe:2.3:o:zyxel:zywall_atp100_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Zywall Atp100 » Version: N/A
Zyxel » Zywall Atp100w Firmware
Versions from including (>=) 4.32 and before (<) 5.37
cpe:2.3:o:zyxel:zywall_atp100w_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Zywall Atp100w » Version: N/A
Zyxel » Zywall Atp200 Firmware
Versions from including (>=) 4.32 and before (<) 5.37
cpe:2.3:o:zyxel:zywall_atp200_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Zywall Atp200 » Version: N/A
Zyxel » Zywall Atp500 Firmware
Versions from including (>=) 4.32 and before (<) 5.37
cpe:2.3:o:zyxel:zywall_atp500_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Zywall Atp500 » Version: N/A
Zyxel » Zywall Atp700 Firmware
Versions from including (>=) 4.32 and before (<) 5.37
cpe:2.3:o:zyxel:zywall_atp700_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Zywall Atp700 » Version: N/A
Zyxel » Zywall Atp800 Firmware
Versions from including (>=) 4.32 and before (<) 5.37
cpe:2.3:o:zyxel:zywall_atp800_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Zywall Atp800 » Version: N/A
Zyxel » Zywall Vpn50 Firmware
Versions from including (>=) 4.30 and before (<) 5.37
cpe:2.3:o:zyxel:zywall_vpn50_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Zywall Vpn50 » Version: N/A
Zyxel » Zywall Vpn2s Firmware
Versions from including (>=) 4.30 and before (<) 5.37
cpe:2.3:o:zyxel:zywall_vpn2s_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Zywall Vpn2s » Version: N/A
Zyxel » Usg Flex 50w Firmware
Versions from including (>=) 4.50 and before (<) 5.37
cpe:2.3:o:zyxel:usg_flex_50w_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg Flex 50w » Version: N/A
Zyxel » Nxc2500 Firmware
Versions from including (>=) 6.10\(aaig.0\) and up to, including, (<=) 6.10\(aaig.3\)
cpe:2.3:o:zyxel:nxc2500_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Nxc2500 » Version: N/A
Zyxel » Nxc5500 Firmware
Versions from including (>=) 6.10\(aaos.0\) and up to, including, (<=) 6.10\(aaos.4\)
cpe:2.3:o:zyxel:nxc5500_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Nxc5500 » Version: N/A
Zyxel » Usg Flex 50 Firmware
Versions from including (>=) 4.50 and before (<) 5.37
cpe:2.3:o:zyxel:usg_flex_50_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg Flex 50 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2023-34140

EPSS FAQ

0.10%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 29 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-34140

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
6.5	MEDIUM	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	2.8	3.6	Zyxel Corporation
Attack Vector: Adjacent Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE ids for CVE-2023-34140

CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Assigned by:
- nvd@nist.gov (Primary)
- security@zyxel.com.tw (Secondary)

References for CVE-2023-34140

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-wlan-controllers

Access denied | Zyxel Networks
Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2023-34140

Products affected by CVE-2023-34140

Exploit prediction scoring system (EPSS) score for CVE-2023-34140

CVSS scores for CVE-2023-34140

CWE ids for CVE-2023-34140

References for CVE-2023-34140