CVE-2023-6764 : A format string vulnerability in a function of the IPSec VPN feature in Zyxel AT

A format string vulnerability in a function of the IPSec VPN feature in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 through 5.37 Patch 1, and USG20(W)-VPN series firmware versions from 4.16 through 5.37 Patch 1 could allow an attacker to achieve unauthorized remote code execution by sending a sequence of specially crafted payloads containing an invalid pointer; however, such an attack would require detailed knowledge of an affected device’s memory layout and configuration.

Published 2024-02-20 03:15:08

Updated 2025-01-21 18:36:00

Source Zyxel Corporation

View at NVD, CVE.org

Vulnerability category: Execute code

Products affected by CVE-2023-6764

Zyxel » Atp200 Firmware
Versions from including (>=) 4.32 and before (<) 5.37
cpe:2.3:o:zyxel:atp200_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Atp200 » Version: N/A
Zyxel » Atp200 Firmware » Version: 5.37
cpe:2.3:o:zyxel:atp200_firmware:5.37:-:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Atp200 » Version: N/A
Zyxel » Atp200 Firmware » Version: 5.37 Update Patch1
cpe:2.3:o:zyxel:atp200_firmware:5.37:patch1:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Atp200 » Version: N/A
Zyxel » Atp500 Firmware
Versions from including (>=) 4.32 and before (<) 5.37
cpe:2.3:o:zyxel:atp500_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Atp500 » Version: N/A
Zyxel » Atp500 Firmware » Version: 5.37
cpe:2.3:o:zyxel:atp500_firmware:5.37:-:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Atp500 » Version: N/A
Zyxel » Atp500 Firmware » Version: 5.37 Update Patch1
cpe:2.3:o:zyxel:atp500_firmware:5.37:patch1:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Atp500 » Version: N/A
Zyxel » Atp800 Firmware
Versions from including (>=) 4.32 and before (<) 5.37
cpe:2.3:o:zyxel:atp800_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Atp800 » Version: N/A
Zyxel » Atp800 Firmware » Version: 5.37
cpe:2.3:o:zyxel:atp800_firmware:5.37:-:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Atp800 » Version: N/A
Zyxel » Atp800 Firmware » Version: 5.37 Update Patch1
cpe:2.3:o:zyxel:atp800_firmware:5.37:patch1:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Atp800 » Version: N/A
Zyxel » Usg20-vpn Firmware
Versions from including (>=) 4.16 and before (<) 5.37
cpe:2.3:o:zyxel:usg20-vpn_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg20-vpn » Version: N/A
Zyxel » Usg20-vpn Firmware » Version: 5.37
cpe:2.3:o:zyxel:usg20-vpn_firmware:5.37:-:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg20-vpn » Version: N/A
Zyxel » Usg20-vpn Firmware » Version: 5.37 Update Patch1
cpe:2.3:o:zyxel:usg20-vpn_firmware:5.37:patch1:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg20-vpn » Version: N/A
Zyxel » Usg20w-vpn Firmware
Versions from including (>=) 4.16 and before (<) 5.37
cpe:2.3:o:zyxel:usg20w-vpn_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg20w-vpn » Version: N/A
Zyxel » Usg20w-vpn Firmware » Version: 5.37
cpe:2.3:o:zyxel:usg20w-vpn_firmware:5.37:-:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg20w-vpn » Version: N/A
Zyxel » Usg20w-vpn Firmware » Version: 5.37 Update Patch1
cpe:2.3:o:zyxel:usg20w-vpn_firmware:5.37:patch1:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg20w-vpn » Version: N/A
Zyxel » Atp100 Firmware
Versions from including (>=) 4.32 and before (<) 5.37
cpe:2.3:o:zyxel:atp100_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Atp100 » Version: N/A
Zyxel » Atp100 Firmware » Version: 5.37
cpe:2.3:o:zyxel:atp100_firmware:5.37:-:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Atp100 » Version: N/A
Zyxel » Atp100 Firmware » Version: 5.37 Update Patch1
cpe:2.3:o:zyxel:atp100_firmware:5.37:patch1:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Atp100 » Version: N/A
Zyxel » Usg Flex 100 Firmware
Versions from including (>=) 4.50 and before (<) 5.37
cpe:2.3:o:zyxel:usg_flex_100_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg Flex 100 » Version: N/A
Zyxel » Usg Flex 100 Firmware » Version: 5.37
cpe:2.3:o:zyxel:usg_flex_100_firmware:5.37:-:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg Flex 100 » Version: N/A
Zyxel » Usg Flex 100 Firmware » Version: 5.37 Update Patch1
cpe:2.3:o:zyxel:usg_flex_100_firmware:5.37:patch1:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg Flex 100 » Version: N/A
Zyxel » Usg Flex 200 Firmware
Versions from including (>=) 4.50 and before (<) 5.37
cpe:2.3:o:zyxel:usg_flex_200_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg Flex 200 » Version: N/A
Zyxel » Usg Flex 200 Firmware » Version: 5.37
cpe:2.3:o:zyxel:usg_flex_200_firmware:5.37:-:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg Flex 200 » Version: N/A
Zyxel » Usg Flex 200 Firmware » Version: 5.37 Update Patch1
cpe:2.3:o:zyxel:usg_flex_200_firmware:5.37:patch1:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg Flex 200 » Version: N/A
Zyxel » Usg Flex 500 Firmware
Versions from including (>=) 4.50 and before (<) 5.37
cpe:2.3:o:zyxel:usg_flex_500_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg Flex 500 » Version: N/A
Zyxel » Usg Flex 500 Firmware » Version: 5.37
cpe:2.3:o:zyxel:usg_flex_500_firmware:5.37:-:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg Flex 500 » Version: N/A
Zyxel » Usg Flex 500 Firmware » Version: 5.37 Update Patch1
cpe:2.3:o:zyxel:usg_flex_500_firmware:5.37:patch1:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg Flex 500 » Version: N/A
Zyxel » Usg Flex 100w Firmware
Versions from including (>=) 4.50 and before (<) 5.37
cpe:2.3:o:zyxel:usg_flex_100w_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg Flex 100w » Version: N/A
Zyxel » Usg Flex 100w Firmware » Version: 5.37
cpe:2.3:o:zyxel:usg_flex_100w_firmware:5.37:-:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg Flex 100w » Version: N/A
Zyxel » Usg Flex 100w Firmware » Version: 5.37 Update Patch1
cpe:2.3:o:zyxel:usg_flex_100w_firmware:5.37:patch1:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg Flex 100w » Version: N/A
Zyxel » Usg Flex 700 Firmware
Versions from including (>=) 4.50 and before (<) 5.37
cpe:2.3:o:zyxel:usg_flex_700_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg Flex 700 » Version: N/A
Zyxel » Usg Flex 700 Firmware » Version: 5.37
cpe:2.3:o:zyxel:usg_flex_700_firmware:5.37:-:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg Flex 700 » Version: N/A
Zyxel » Usg Flex 700 Firmware » Version: 5.37 Update Patch1
cpe:2.3:o:zyxel:usg_flex_700_firmware:5.37:patch1:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg Flex 700 » Version: N/A
Zyxel » Atp100w Firmware
Versions from including (>=) 4.32 and before (<) 5.37
cpe:2.3:o:zyxel:atp100w_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Atp100w » Version: N/A
Zyxel » Atp100w Firmware » Version: 5.37
cpe:2.3:o:zyxel:atp100w_firmware:5.37:-:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Atp100w » Version: N/A
Zyxel » Atp100w Firmware » Version: 5.37 Update Patch1
cpe:2.3:o:zyxel:atp100w_firmware:5.37:patch1:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Atp100w » Version: N/A
Zyxel » Atp700 Firmware
Versions from including (>=) 4.32 and before (<) 5.37
cpe:2.3:o:zyxel:atp700_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Atp700 » Version: N/A
Zyxel » Atp700 Firmware » Version: 5.37
cpe:2.3:o:zyxel:atp700_firmware:5.37:-:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Atp700 » Version: N/A
Zyxel » Atp700 Firmware » Version: 5.37 Update Patch1
cpe:2.3:o:zyxel:atp700_firmware:5.37:patch1:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Atp700 » Version: N/A
Zyxel » Usg Flex 50w Firmware
Versions from including (>=) 4.16 and before (<) 5.37
cpe:2.3:o:zyxel:usg_flex_50w_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg Flex 50w » Version: N/A
Zyxel » Usg Flex 50w Firmware » Version: 5.37
cpe:2.3:o:zyxel:usg_flex_50w_firmware:5.37:-:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg Flex 50w » Version: N/A
Zyxel » Usg Flex 50w Firmware » Version: 5.37 Update Patch1
cpe:2.3:o:zyxel:usg_flex_50w_firmware:5.37:patch1:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg Flex 50w » Version: N/A
Zyxel » Usg Flex 50 Firmware
Versions from including (>=) 4.16 and before (<) 5.37
cpe:2.3:o:zyxel:usg_flex_50_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg Flex 50 » Version: N/A
Zyxel » Usg Flex 50 Firmware » Version: 5.37
cpe:2.3:o:zyxel:usg_flex_50_firmware:5.37:-:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg Flex 50 » Version: N/A
Zyxel » Usg Flex 50 Firmware » Version: 5.37 Update Patch1
cpe:2.3:o:zyxel:usg_flex_50_firmware:5.37:patch1:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg Flex 50 » Version: N/A
Zyxel » Usg Flex 100ax Firmware
Versions from including (>=) 4.50 and before (<) 5.37
cpe:2.3:o:zyxel:usg_flex_100ax_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg Flex 100ax » Version: N/A
Zyxel » Usg Flex 100ax Firmware » Version: 5.37
cpe:2.3:o:zyxel:usg_flex_100ax_firmware:5.37:-:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg Flex 100ax » Version: N/A
Zyxel » Usg Flex 100ax Firmware » Version: 5.37 Update Patch1
cpe:2.3:o:zyxel:usg_flex_100ax_firmware:5.37:patch1:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg Flex 100ax » Version: N/A
Zyxel » Usg Flex 100h Firmware
Versions from including (>=) 4.50 and before (<) 5.37
cpe:2.3:o:zyxel:usg_flex_100h_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg Flex 100h » Version: N/A
Zyxel » Usg Flex 100h Firmware » Version: 5.37
cpe:2.3:o:zyxel:usg_flex_100h_firmware:5.37:-:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg Flex 100h » Version: N/A
Zyxel » Usg Flex 100h Firmware » Version: 5.37 Update Patch1
cpe:2.3:o:zyxel:usg_flex_100h_firmware:5.37:patch1:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg Flex 100h » Version: N/A
Zyxel » Usg Flex 200h Firmware
Versions from including (>=) 4.50 and before (<) 5.37
cpe:2.3:o:zyxel:usg_flex_200h_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg Flex 200h » Version: N/A
Zyxel » Usg Flex 200h Firmware » Version: 5.37
cpe:2.3:o:zyxel:usg_flex_200h_firmware:5.37:-:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg Flex 200h » Version: N/A
Zyxel » Usg Flex 200h Firmware » Version: 5.37 Update Patch1
cpe:2.3:o:zyxel:usg_flex_200h_firmware:5.37:patch1:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg Flex 200h » Version: N/A
Zyxel » Usg Flex 200hp Firmware
Versions from including (>=) 4.50 and before (<) 5.37
cpe:2.3:o:zyxel:usg_flex_200hp_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg Flex 200hp » Version: N/A
Zyxel » Usg Flex 200hp Firmware » Version: 5.37
cpe:2.3:o:zyxel:usg_flex_200hp_firmware:5.37:-:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg Flex 200hp » Version: N/A
Zyxel » Usg Flex 200hp Firmware » Version: 5.37 Update Patch1
cpe:2.3:o:zyxel:usg_flex_200hp_firmware:5.37:patch1:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg Flex 200hp » Version: N/A
Zyxel » Usg Flex 500h Firmware
Versions from including (>=) 4.50 and before (<) 5.37
cpe:2.3:o:zyxel:usg_flex_500h_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg Flex 500h » Version: N/A
Zyxel » Usg Flex 500h Firmware » Version: 5.37
cpe:2.3:o:zyxel:usg_flex_500h_firmware:5.37:-:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg Flex 500h » Version: N/A
Zyxel » Usg Flex 500h Firmware » Version: 5.37 Update Patch1
cpe:2.3:o:zyxel:usg_flex_500h_firmware:5.37:patch1:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg Flex 500h » Version: N/A
Zyxel » Usg Flex 700h Firmware
Versions from including (>=) 4.50 and before (<) 5.37
cpe:2.3:o:zyxel:usg_flex_700h_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg Flex 700h » Version: N/A
Zyxel » Usg Flex 700h Firmware » Version: 5.37
cpe:2.3:o:zyxel:usg_flex_700h_firmware:5.37:-:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg Flex 700h » Version: N/A
Zyxel » Usg Flex 700h Firmware » Version: 5.37 Update Patch1
cpe:2.3:o:zyxel:usg_flex_700h_firmware:5.37:patch1:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg Flex 700h » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2023-6764

EPSS FAQ

1.59%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 80 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-6764

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
8.1	HIGH	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	2.2	5.9	Zyxel Corporation	2024-02-20
Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2023-6764

CWE-134 Use of Externally-Controlled Format String

The product uses a function that accepts a format string as an argument, but the format string originates from an external source.
Assigned by:
- nvd@nist.gov (Primary)
- security@zyxel.com.tw (Secondary)

References for CVE-2023-6764

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-aps-02-20-2024

Zyxel security advisory for multiple vulnerabilities in firewalls and APs | Zyxel Networks
Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2023-6764

Products affected by CVE-2023-6764

Exploit prediction scoring system (EPSS) score for CVE-2023-6764

CVSS scores for CVE-2023-6764

CWE ids for CVE-2023-6764

References for CVE-2023-6764