CyberSecBulletin
CVE-2023-6764NVD status: Analyzed

ATP series firmware: Use of Externally-Controlled Format String

Published Updated By the CyberSecBulletin desk

CVE-2023-6764 is a high-severity use of externally-controlled format string vulnerability in ATP series firmware from Zyxel, with a CVSS 3.1 base score of 8.1 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. Affected ATP series firmware versions: version 4.32 through 5.37 Patch 1. The record does not name a fixed version, so check the vendor advisory. There is no confirmed exploitation so far. EPSS estimates a 0.89% chance of exploitation within 30 days, higher than 60% of scored CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Atp100 Firmware to 5.37 or a later version.
  2. Update Atp100w Firmware to 5.37 or a later version.
  3. Update Atp200 Firmware to 5.37 or a later version.
  4. Read the advisory on zyxel.com for workarounds and exact fixed builds.
  5. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
ZyxelATP series firmwareversion 4.32 through 5.37 Patch 1Not stated
ZyxelUSG FLEX series firmwareversion 4.50 through 5.37 Patch 1Not stated
ZyxelUSG FLEX 50(W) series firmwareversion 4.16 through 5.37 Patch 1Not stated
ZyxelUSG20(W)-VPN series firmwareversion 4.16 through 5.37 Patch 1Not stated
Zyxelatp_firmware4.32 through 5.37patch1Not stated
Zyxelusg_flex_firmware4.50 through 5.37patch1Not stated
Zyxelusg_flex_50w_firmware4.16 through 5.37patch1Not stated
Zyxelusg_20w-vpn_firmware4.16 through 5.37patch1Not stated
ZyxelAtp100 Firmware4.32 up to, but not including, 5.37; 5.375.37
ZyxelAtp100w Firmware4.32 up to, but not including, 5.37; 5.375.37
ZyxelAtp200 Firmware4.32 up to, but not including, 5.37; 5.375.37
ZyxelAtp500 Firmware4.32 up to, but not including, 5.37; 5.375.37
ZyxelAtp700 Firmware4.32 up to, but not including, 5.37; 5.375.37
ZyxelAtp800 Firmware4.32 up to, but not including, 5.37; 5.375.37
ZyxelUsg Flex 100 Firmware4.50 up to, but not including, 5.37; 5.375.37
ZyxelUsg Flex 100ax Firmware4.50 up to, but not including, 5.37; 5.375.37
ZyxelUsg Flex 100h Firmware4.50 up to, but not including, 5.37; 5.375.37
ZyxelUsg Flex 100w Firmware4.50 up to, but not including, 5.37; 5.375.37
ZyxelUsg Flex 200 Firmware4.50 up to, but not including, 5.37; 5.375.37
ZyxelUsg Flex 200h Firmware4.50 up to, but not including, 5.37; 5.375.37
ZyxelUsg Flex 200hp Firmware4.50 up to, but not including, 5.37; 5.375.37
ZyxelUsg Flex 500 Firmware4.50 up to, but not including, 5.37; 5.375.37
ZyxelUsg Flex 500h Firmware4.50 up to, but not including, 5.37; 5.375.37
ZyxelUsg Flex 700 Firmware4.50 up to, but not including, 5.37; 5.375.37
ZyxelUsg Flex 700h Firmware4.50 up to, but not including, 5.37; 5.375.37

Version data comes from the organisation that assigned the CVE; 3 further products are omitted here. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
HighSuccess depends on conditions outside the attacker's control.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by CNA (zyxel.com.tw).

Official description

A format string vulnerability in a function of the IPSec VPN feature in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 through 5.37 Patch 1, and USG20(W)-VPN series firmware versions from 4.16 through 5.37 Patch 1 could allow an attacker to achieve unauthorized remote code execution by sending a sequence of specially crafted payloads containing an invalid pointer; however, such an attack would require detailed knowledge of an affected device’s memory layout and configuration.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Use of Externally-Controlled Format String

The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

How developers prevent this class of flaw

  • Choose a language that is not subject to this flaw.
  • Ensure that all format string functions are passed a static string which cannot be controlled by the user, and that the proper number of arguments are always sent to that function as well. If at all possible, use functions that do not support the %n operator in format strings.
  • Run compilers and linkers with high warning levels, since they may detect incorrect usage.

More Use of Externally-Controlled Format String vulnerabilities (CWE-134)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Other vulnerabilities in ATP series firmware

All ATP series firmware vulnerabilities

Recent Use of Externally-Controlled Format String vulnerabilities

Spotted an error? Tell us.