Zyxel Issues Critical Security Patches for Firewall and VPN Products


May 25, 2023Ravie LakshmananNetwork Security / Vulnerabilities


Zyxel has released a software update to address two critical security flaws affecting certain firewall and VPN products that could be abused by remote attackers to achieve code execution.

The two drawbacks- CVE-2023-33009 and CVE-2023-33010 – is buffer overflow vulnerability and is rated 9.8 out of 10 on the CVSS rating system.

A brief description of the two issues is below –

  • CVE-2023-33009 – A buffer overflow vulnerability in the notification function that could enable an unauthenticated attacker to cause a denial-of-service (DoS) condition and remote code execution.
  • CVE-2023-33010 – Buffer overflow vulnerabilities in ID processing functionality that could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and remote code execution.

The following devices are affected –

  • ATP (ZLD versions V4.32 to V5.36 Patch 1, patched in ZLD V5.36 Patch 2)
  • USG FLEX (ZLD version V4.50 to V5.36 Patch 1, patched in ZLD V5.36 Patch 2)
  • USG FLEX50(W) / USG20(W)-VPN (ZLD V4.25 to V5.36 Patch 1 version, patched in ZLD V5.36 Patch 2)
  • VPN (version ZLD V4.30 to V5.36 Patch 1, patched in ZLD V5.36 Patch 2), and
  • ZyWALL/USG (ZLD version V4.25 to V4.73 Patch 1, patched in ZLD V4.73 Patch 2)

Security researchers from TRAPA Security and STAR Labs SG have found and reported the flaw.


Zero Trust + Deception: Learn How to Outsmart Attackers!

Discover how Fraud can detect advanced threats, stop lateral moves, and improve your Zero Trust strategy. Join our insightful webinar!

Save My Seat!

The advice comes less than a month after Zyxel shipped a fix for another critical security flaw in its firewall suite that could be exploited to achieve remote code execution on affected systems.

The problem is, being tracked as CVE-2023-28771 (CVSS score: 9.8), also credited to TRAPA Security, with network equipment makers blaming improper handling of error messages. Since then it has been under active exploitation by threat actors associated with the Mirai botnet.

Found this article interesting? Follow us on Twitter And LinkedIn to read more exclusive content we post.


Source link

Related Articles

Back to top button