Zyxel alerts of critical vulnerabilities in firewall and VPN devices
Take action: When your firewall and VPN devices, which are exposed to the open internet are critically exploitable, it's no time for a snarky comment. Roll up your sleeves and go patch. If you don't you'll quickly find yourself on the receiving end of an automated attack.
Learn More
Zyxel has issued a warning regarding critical vulnerabilities found in several of their firewall and VPN devices. These vulnerabilities pose critical risks as they can be exploited by attackers without requiring authentication.
Zyxel has taken action by releasing patches to address the buffer overflow vulnerabilities affecting their firewalls. They strongly advise users to install these patches to ensure optimal protection.
The security issues are specifically related to buffer overflows, when memory manipulation allows attackers to write data beyond the allocated section. While they typically result in system crashes, successful exploitation can grant attackers the ability to execute code on the compromised device.
The latest patch from Zyxel aims to resolve the following issues:
- CVE-2023-33009: This vulnerability involves a buffer overflow in the notification function of select Zyxel products. It enables an unauthenticated attacker to execute remote code or cause DoS conditions, with a critical severity score of 9.8.
- CVE-2023-33010: This vulnerability relates to a buffer overflow in the ID processing function of certain Zyxel products. Similar to the previous flaw, it allows unauthenticated attackers to execute remote code or impose DoS conditions, also with a critical severity score of 9.8.
Zyxel has identified the following firmware versions as being vulnerable, which are commonly utilized by small to medium-sized businesses to safeguard their networks and enable secure network access for remote or home-based workers via VPNs:
- Zyxel ATP firmware versions ZLD V4.32 to V5.36 Patch 1 (resolved in ZLD V5.36 Patch 2)
- Zyxel USG FLEX firmware versions ZLD V4.50 to V5.36 Patch 1 (resolved in ZLD V5.36 Patch 2)
- Zyxel USG FLEX50(W) / USG20(W)-VPN firmware versions ZLD V4.25 to V5.36 Patch 1 (resolved in ZLD V5.36 Patch 2)
- Zyxel VPN firmware versions ZLD V4.30 to V5.36 Patch 1 (resolved in ZLD V5.36 Patch 2)
- Zyxel ZyWALL/USG firmware versions ZLD V4.25 to V4.73 Patch 1 (resolved in ZLD V4.73 Patch 2)
