Skip to content
Fencer Vulns
medium 5.7

CVE-2023-6399 json

A format string vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from…

published 2024-02-20 2 y ago modified 2026-06-17 4 mo ago also EUVD-2023-58636

cvss
5.7
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 51%
public exploits
0
none known

Summary

A format string vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 through 5.37 Patch 1, USG20(W)-VPN series firmware versions from 4.16 through 5.37 Patch 1, and USG FLEX H series firmware versions from 1.10 through 1.10 Patch 1 could allow an authenticated IPSec VPN user to cause DoS conditions against the “deviceid” daemon by sending a crafted hostname to an affected device if it has the “Device Insight” feature enabled.

Patch / fix

  • zyxel atp100_firmware 5.37
  • zyxel atp100w_firmware 5.37
  • zyxel atp200_firmware 5.37
  • zyxel atp500_firmware 5.37
  • zyxel atp700_firmware 5.37
  • zyxel atp800_firmware 5.37
  • zyxel usg_flex_100_firmware 5.37
  • zyxel usg_flex_100ax_firmware 5.37
  • zyxel usg_flex_100h_firmware 5.37
  • zyxel usg_flex_100w_firmware 5.37
  • zyxel usg_flex_200_firmware 5.37
  • zyxel usg_flex_200h_firmware 5.37
  • zyxel usg_flex_200hp_firmware 5.37
  • zyxel usg_flex_500_firmware 5.37
  • zyxel usg_flex_500h_firmware 5.37
  • zyxel usg_flex_700_firmware 5.37
  • zyxel usg_flex_700h_firmware 5.37
  • zyxel usg_flex_50_firmware 5.37
  • zyxel usg_flex_50w_firmware 5.37
  • zyxel usg20-vpn_firmware 5.37

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.65% chance of exploitation in the next 30 days, higher than 51% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.7 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

  • Zyxel ATP series firmware
  • Zyxel USG FLEX series firmware
  • Zyxel USG FLEX 50(W) series firmware
  • Zyxel USG20(W)-VPN series firmware
  • Zyxel USG FLEX H series firmware

Classification

Weakness
  • CWE-134 Use of Externally-Controlled Format String

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.