What’s Vulnerable › Vulnerabilities

CVE-2023-6764

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-02-20 · updated 2026-06-17
• Weakness: CWE-134

Description

A format string vulnerability in a function of the IPSec VPN feature in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 through 5.37 Patch 1, and USG20(W)-VPN series firmware versions from 4.16 through 5.37 Patch 1 could allow an attacker to achieve unauthorized remote code execution by sending a sequence of specially crafted payloads containing an invalid pointer; however, such an attack would require detailed knowledge of an affected device’s memory layout and configuration.

Affected products

• Zyxel Atp100 Firmware: from 4.32 before 5.37; 5.37, 5.37-patch1 — fixed in 5.37
• Zyxel Atp100W Firmware: from 4.32 before 5.37; 5.37, 5.37-patch1 — fixed in 5.37
• Zyxel Atp200 Firmware: from 4.32 before 5.37; 5.37, 5.37-patch1 — fixed in 5.37
• Zyxel Atp500 Firmware: from 4.32 before 5.37; 5.37, 5.37-patch1 — fixed in 5.37
• Zyxel Atp700 Firmware: from 4.32 before 5.37; 5.37, 5.37-patch1 — fixed in 5.37
• Zyxel Atp800 Firmware: from 4.32 before 5.37; 5.37, 5.37-patch1 — fixed in 5.37
• Zyxel Usg20-Vpn Firmware: from 4.16 before 5.37; 5.37, 5.37-patch1 — fixed in 5.37
• Zyxel USG20(W)-VPN firmware: from 4.16 before 5.37; 5.37, 5.37-patch1 — fixed in 5.37
• Zyxel firewall (ZLD): from 4.50 before 5.37; 5.37, 5.37-patch1 — fixed in 5.37
• Zyxel Usg Flex 100Ax Firmware: from 4.50 before 5.37; 5.37, 5.37-patch1 — fixed in 5.37
• Zyxel Usg Flex 100H Firmware: from 4.50 before 5.37; 5.37, 5.37-patch1 — fixed in 5.37
• Zyxel USG FLEX 100(W) firmware: from 4.50 before 5.37; 5.37, 5.37-patch1 — fixed in 5.37
• Zyxel USG FLEX 200 firmware: from 4.50 before 5.37; 5.37, 5.37-patch1 — fixed in 5.37
• Zyxel Usg Flex 200H Firmware: from 4.50 before 5.37; 5.37, 5.37-patch1 — fixed in 5.37
• Zyxel Usg Flex 200Hp Firmware: from 4.50 before 5.37; 5.37, 5.37-patch1 — fixed in 5.37
• Zyxel USG FLEX 500 firmware: from 4.50 before 5.37; 5.37, 5.37-patch1 — fixed in 5.37
• Zyxel Usg Flex 500H Firmware: from 4.50 before 5.37; 5.37, 5.37-patch1 — fixed in 5.37
• Zyxel Usg Flex 50 Firmware: from 4.16 before 5.37; 5.37, 5.37-patch1 — fixed in 5.37
• Zyxel USG FLEX 50(W) firmware: from 4.16 before 5.37; 5.37, 5.37-patch1 — fixed in 5.37
• Zyxel USG FLEX 700 firmware: from 4.50 before 5.37; 5.37, 5.37-patch1 — fixed in 5.37
• Zyxel Usg Flex 700H Firmware: from 4.50 before 5.37; 5.37, 5.37-patch1 — fixed in 5.37

How to fix

Upgrade to a fixed version: Zyxel Atp100 Firmware 5.37; Zyxel Atp100W Firmware 5.37; Zyxel Atp200 Firmware 5.37; Zyxel Atp500 Firmware 5.37; Zyxel Atp700 Firmware 5.37; Zyxel Atp800 Firmware 5.37; Zyxel Usg20-Vpn Firmware 5.37; Zyxel USG20(W)-VPN firmware 5.37; Zyxel firewall (ZLD) 5.37; Zyxel Usg Flex 100Ax Firmware 5.37; Zyxel Usg Flex 100H Firmware 5.37; Zyxel USG FLEX 100(W) firmware 5.37. Check the vendor advisory for mitigations.

References

• https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-aps-02-20-2024
• https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-aps-02-20-2024

Get alerted when CVE-2023-6764 or the next vulnerability affects your stack