Skip to content
Fencer Vulns
high 8.8

CVE-2023-33011 json

A format string vulnerability in the Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 t…

published 2023-07-17 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-37200

cvss
8.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 27%
public exploits
0
none known

Summary

A format string vulnerability in the Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through 5.36 Patch 2, USG FLEX 50(W) series firmware versions 5.10 through 5.36 Patch 2, USG20(W)-VPN series firmware versions 5.10 through 5.36 Patch 2, and VPN series firmware versions 5.00 through 5.36 Patch 2, could allow an unauthenticated, LAN-based attacker to execute some OS commands by using a crafted PPPoE configuration on an affected device when the cloud management mode is enabled.

Patch / fix

  • zyxel usg_2200-vpn_firmware 5.37
  • zyxel usg_flex_100_firmware 5.37
  • zyxel usg_flex_100w_firmware 5.37
  • zyxel usg_flex_200_firmware 5.37
  • zyxel usg_flex_50_firmware 5.37
  • zyxel usg_flex_500_firmware 5.37
  • zyxel usg_flex_50w_firmware 5.37
  • zyxel usg_flex_700_firmware 5.37
  • zyxel zywall_vpn100_firmware 5.37
  • zyxel zywall_vpn2s_firmware 5.37
  • zyxel zywall_vpn300_firmware 5.37
  • zyxel zywall_vpn50_firmware 5.37
  • zyxel zywall_vpn_100_firmware 5.37
  • zyxel zywall_vpn_300_firmware 5.37
  • zyxel zywall_vpn_50_firmware 5.37
  • zyxel usg_20w-vpn_firmware 5.37
  • zyxel zywall_atp100_firmware 5.37
  • zyxel zywall_atp100w_firmware 5.37
  • zyxel zywall_atp200_firmware 5.37
  • zyxel zywall_atp500_firmware 5.37

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2 y ago

Exploit prediction

0.34% chance of exploitation in the next 30 days, higher than 27% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Zyxel ATP series firmware
  • Zyxel USG FLEX series firmware
  • Zyxel USG FLEX 50(W) series firmware
  • Zyxel USG20(W)-VPN series firmware
  • Zyxel VPN series firmware
  • zyxel vpn_series_firmware
  • zyxel atp100_firmware
  • zyxel usg_flex_series_firmware
  • zyxel usg_flex_50\/w\/_series_firmware
  • zyxel usg20w-vpn_firmware

Classification

Weakness
  • CWE-134 Use of Externally-Controlled Format String

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.