Skip to content
Fencer Vulns
high 8.1

CVE-2023-6764 json

A format string vulnerability in a function of the IPSec VPN feature in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1,…

published 2024-02-20 2 y ago modified 2026-06-17 4 mo ago also EUVD-2023-58976

cvss
8.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.9%
EPSS 0.9% chance of exploitation in 30 days, percentile 59%
public exploits
0
none known

Summary

A format string vulnerability in a function of the IPSec VPN feature in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 through 5.37 Patch 1, and USG20(W)-VPN series firmware versions from 4.16 through 5.37 Patch 1 could allow an attacker to achieve unauthorized remote code execution by sending a sequence of specially crafted payloads containing an invalid pointer; however, such an attack would require detailed knowledge of an affected device’s memory layout and configuration.

Patch / fix

  • zyxel atp100_firmware 5.37
  • zyxel atp100w_firmware 5.37
  • zyxel atp200_firmware 5.37
  • zyxel atp500_firmware 5.37
  • zyxel atp700_firmware 5.37
  • zyxel atp800_firmware 5.37
  • zyxel usg_flex_100_firmware 5.37
  • zyxel usg_flex_100ax_firmware 5.37
  • zyxel usg_flex_100h_firmware 5.37
  • zyxel usg_flex_100w_firmware 5.37
  • zyxel usg_flex_200_firmware 5.37
  • zyxel usg_flex_200h_firmware 5.37
  • zyxel usg_flex_200hp_firmware 5.37
  • zyxel usg_flex_500_firmware 5.37
  • zyxel usg_flex_500h_firmware 5.37
  • zyxel usg_flex_700_firmware 5.37
  • zyxel usg_flex_700h_firmware 5.37
  • zyxel usg_flex_50_firmware 5.37
  • zyxel usg_flex_50w_firmware 5.37
  • zyxel usg20-vpn_firmware 5.37

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2 y ago

Exploit prediction

0.89% chance of exploitation in the next 30 days, higher than 59% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Zyxel ATP series firmware
  • Zyxel USG FLEX series firmware
  • Zyxel USG FLEX 50(W) series firmware
  • Zyxel USG20(W)-VPN series firmware
  • zyxel atp_firmware
  • zyxel usg_flex_firmware
  • zyxel usg_flex_50w_firmware
  • zyxel usg_20w-vpn_firmware

Classification

Weakness
  • CWE-134 Use of Externally-Controlled Format String

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.