CVE-2023-33009

CVE-2023-33009 is an unauthenticated buffer overflow (CWE-120) in the notification function of Zyxel firewall firmware. A remote attacker who can reach the affected device can send crafted input to the notification function without any credentials, overflowing a buffer. Successful exploitation can crash the device (denial of service) and enable remote code execution on the appliance. Affected products are Zyxel ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN, and ZyWALL/USG series firewalls, which are commonly deployed as perimeter and VPN gateways in small and mid-size networks. The flaw was added to the CISA Known Exploited Vulnerabilities catalog on 2023-06-05, indicating observed exploitation in the wild; no public proof-of-concept is known, and EPSS assigns a 28.1% probability of exploitation within 30 days (98th percentile).

What to do: Apply the fixed firmware for CVE-2023-33009 from Zyxel's security advisory, per the CISA KEV required action (specific fixed versions are not listed in the source data). Until patched, restrict internet exposure of device management, notification, and VPN interfaces and watch for unexpected crashes or reboots on affected ATP, USG FLEX, VPN, or ZyWALL/USG appliances.