CVE-2023-33011

CVSS 3.1 Score 8.8 of 10 (high)

Details

Published Jul 17, 2023
Updated: Jul 26, 2023
CWE ID 134

Summary

CVE-2023-33011 is a format string vulnerability that affects Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through 5.36 Patch 2, USG FLEX 50(W) series firmware versions 5.10 through 5.36 Patch 2, USG20(W)-VPN series firmware versions 5.10 through 5.36 Patch 2, and VPN series firmware versions 5.00 through 5.36 Patch 2. This vulnerability could be exploited by an unauthenticated attacker within the LAN using a crafted PPPoE configuration on an affected device when the cloud management mode is enabled. It allows the attacker to execute some OS commands. The risk score for this vulnerability is high (67), and it has a base severity rating of high (8.8). The potential impact includes high integrity and confidentiality impact, with a CVSS vector string of "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H". No remediation steps are mentioned in the provided information, but affected organizations should consider applying any available patches or security updates provided by Zyxel to mitigate the risk posed by this vulnerability. Note: The provided information lacks details on how to remediate this vulnerability, so additional sources or information may be needed for a complete understanding of mitigation steps.

Share

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-33011 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options