Zyxel Firewalls and VPN Devices ID Processing Function Buffer Overflow Vulnerability (CVE-2023-33010) Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTSpecific firmware versions of Zyxel ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN, and ZyWALL/USG series
Unauthenticated remote attackers can cause denial-of-service (DoS) conditions or execute arbitrary code on the affected device
Immediately upgrade the device firmware to the latest patched version (v5.36 Patch 2 or v4.73 Patch 2 or higher)
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Download and apply the latest firmware patch (v5.36 Patch 2 or v4.73 Patch 2 or higher depending on the model) from the official Zyxel support portal. You can perform the firmware upgrade via CLI as follows:
# Transfer the firmware image via SFTP/FTP and apply it
router# copy sftp firmware running-firmware
# Verify the upgrade and reboot status
router# show version2. Temporary Workaround & Hardening Configuration
If immediate patching is not feasible, restrict access to the device's management interfaces (HTTP/HTTPS) from the WAN. Implement strict firewall rules to allow access only from trusted administrative IP addresses.
# Example: Restricting HTTPS management access from WAN
router# configure terminal
router(config)# address-object Admin_Allowed_IPs ipv4 192.168.10.0/24
router(config)# service-group HTTPS_Port
router(config-service-group)# service HTTPS
router(config)# policy-rule Admin_Access_Control
router(config-policy-rule)# action permit
router(config-policy-rule)# source Admin_Allowed_IPs
router(config-policy-rule)# destination any
router(config-policy-rule)# service HTTPS_Port3. Log Audit & IoC Verification Commands
Inspect the system logs for any unusual process crashes or requests containing abnormally long strings.
# Check system logs for crash or overflow indicators via CLI
router# show logging system | match 'crash|error|overflow'
router# show versionStop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access
Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2023-33010) is a classic buffer overflow (CWE-120) residing in the ID processing function of Zyxel firewall and VPN device firmwares. It occurs due to a lack of proper boundary checks when copying input data into a fixed-size memory buffer, allowing input values to exceed the allocated buffer size.
2. Exploitation Mechanics & Attack Scenario
An unauthenticated remote attacker can exploit this vulnerability by sending specially crafted packets containing malicious ID parameters to the device's management interface or VPN service ports. When the ID processing function processes this input, it overwrites adjacent memory spaces on the stack or heap. This allows the attacker to hijack the execution flow (e.g., overwriting the EIP/RIP registers) to execute arbitrary shellcode or crash critical system processes, leading to a Denial of Service (DoS).
3. Infrastructure & Business Impact
With a CVSS score of 9.8 (Critical) and its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog, this vulnerability is actively being exploited in the wild. Since firewalls and VPN gateways serve as the perimeter defense for enterprise networks, compromise of these devices can lead to unauthorized internal network access, lateral movement, and severe business disruption.
Official Vendor Advisories & References
A buffer overflow vulnerability in the ID processing function in Zyxel ATP series firmware versions 4.32 through 5.36 Patch 1, USG FLEX series firmware versions 4.50 through 5.36 Patch 1, USG FLEX 50(W) firmware versions 4.25 through 5.36 Patch 1, USG20(W)-VPN firmware versions 4.25 through 5.36 Patch 1, VPN series firmware versions 4.30 through 5.36 Patch 1, ZyWALL/USG series firmware versions 4.25 through 4.73 Patch 1, could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and even a remote code execution on an affected device.
Frequently Asked SecOps Questions (CVE-2023-33010)
FAQQ1. How critical is CVE-2023-33010 and is it actively exploited in the wild?
CVE-2023-33010 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 29.0%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2023-33010?
Primary impacted vendors include zyxel across atp series firmware, usg flex series firmware, usg flex 50 firmware, usg flex 50w firmware, usg20-vpn firmware, usg20w-vpn firmware, vpn series firmware, zywall series firmware, usg series firmware. Scope summary: Zyxel ATP (v4.32 to v5.36 Patch 1), USG FLEX (v4.50 to v5.36 Patch 1), USG FLEX 50(W) (v4.25 to v5.36 Patch 1), USG20(W)-VPN (v4.25 to v5.36 Patch 1), VPN (v4.30 to v5.36 Patch 1), ZyWALL/USG (v4.25 to v4.73 Patch 1)
Q3. What temporary mitigations or workarounds exist for CVE-2023-33010 before patching?
[Mitigation] Immediately upgrade the device firmware to the latest patched version (v5.36 Patch 2 or v4.73 Patch 2 or higher) Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2023-33010
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (zyxel)
View Category →Zyxel GS1900 Series Switch CGI Stack-based Buffer Overflow Remote Code Execution (RCE) Advisory (CVE-2026-7273)
[Affected Scope] Zyxel GS1900-48HPv2 firmware versions up to 2.90(ABTQ.1)C0.
Arista VeloCloud Orchestrator (VCO) Remote Code Execution and Privilege Escalation (CVE-2026-93952)
[Affected Scope] Arista VeloCloud Orchestrator (VCO) On-premise deployments.
Cisco Identity Services Engine (ISE) Critical Authentication Bypass Vulnerability (CVE-2026-76460)
[Affected Scope] Cisco Identity Services Engine (ISE) web-based management interface and API endpoints.
SonicWall SMA1000 Work Place Pre-Authentication Server-Side Request Forgery (SSRF) Vulnerability (CVE-2026-83548)
[Affected Scope] SonicWall SMA1000 Series Appliance Work Place interface
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.