A buffer overflow vulnerability in the Zyxel ATP series firmware version 5.37, USG FLEX series firmware version 5.37, USG FLEX 50(W)…

Description

A buffer overflow vulnerability in the Zyxel ATP series firmware version 5.37, USG FLEX series firmware version 5.37, USG FLEX 50(W) series firmware version 5.37, and USG20(W)-VPN series firmware version 5.37, could allow an authenticated local attacker with administrator privileges to cause denial-of-service (DoS) conditions by executing the CLI command with crafted strings on an affected device.

Scores

EPSS (exploitation in 30 days)

0.23% · top 86% of all CVEs (6 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.4.

Weakness

• CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (opens in a new tab)All about CWE-120 and its CVEs

Affected products

• Zyxel · ATP series firmware

  • affected 5.37

• Zyxel · USG FLEX series firmware

  • affected 5.37

• Zyxel · USG FLEX 50(W) series firmware

  • affected 5.37

• Zyxel · USG20(W)-VPN series firmware

  • affected 5.37

References (1)

• https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-aps (opens in a new tab)vendor-advisoryx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2023-4397](https://trackcve.app/badge/CVE-2023-4397.svg)](https://trackcve.app/cve/CVE-2023-4397)

Record last updated 2 Aug 2024, 07:24 UTC.