PT-2023-05: Unauth Buffer Overflow in sdwan_iface_ipc in Zyxel products
Vendor: Zyxel
Vulnerable product: ATP, USG FLEX, USG FLEX 50(W)/ USG20(W)-VPN, VPN
Vulnerable version: ATP - ZLD V5.10~V5.32; USG FLEX - ZLD V5.00~V5.32; USG FLEX 50(W)/ USG20(W)-VPN - ZLD V5.10~V5.32; VPN - ZLD V5.00~V5.35
Vulnerability type:
• CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Identifier (ID):
• BDU:2023-08491
• CVE-2023-22917
Vulnerability vector:
• Base vulnerability score (CVSSv3.1): CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Severity (CVSSv3.1): 7.5(high)
• Base vulnerability score (CVSSv4.0): CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
• Severity (CVSSv4.0): 8.7(high)
Description:
An issue was identified in Zyxel products affecting: ATP (ZLD V5.10~V5.32); USG FLEX (ZLD V5.00~V5.32); USG FLEX 50(W)/ USG20(W)-VPN (ZLD V5.10~V5.32); VPN (ZLD V5.00~V5.35).
The discovered vulnerability of Buffer Overflow in sdwan_iface_ipc can be exploited by an unauthenticated attacker to dump the core with a request error message on a affected device.
Vulnerability status: Confirmed by vendor
Date of vulnerability remediation: 25.04.2023
Recommendations:
• Update to version ZLD V5.36 or higher
Additional information:
Researcher: Nikita Abramov (Positive Technologies)