CVE-2023-22917

Vulnerability

A buffer overflow vulnerability resides in the sdwan_iface_ipc binary of Zyxel ATP series (firmware 5.10 through 5.32), USG FLEX series (5.00 through 5.32), USG FLEX 50(W) (5.10 through 5.32), USG20(W)-VPN (5.10 through 5.32), and VPN series (5.00 through 5.35) [1]. The flaw is triggered during parsing of a crafted configuration file when it is uploaded to the device [1].

Exploitation

An attacker does not require authentication or any prior access to the device [1]. The attack vector is remote: the attacker uploads a specially crafted configuration file to the vulnerable sdwan_iface_ipc binary [1]. No additional user interaction or specific feature enablement is needed beyond the device being reachable over the network [1].

Impact

Successful exploitation causes a core dump with a request error message, resulting in a denial of service (DoS) condition on the affected firewall device [1]. The vulnerability does not provide code execution or data exfiltration; the impact is limited to crashing the device [1].

Mitigation

Zyxel has released firmware updates to address this vulnerability: ATP series version 5.36, USG FLEX series version 5.36, USG FLEX 50(W) version 5.36, USG20(W)-VPN version 5.36, and VPN series version 5.36 [1]. Users are advised to upgrade to the fixed versions immediately [1]. No workaround has been provided. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog as of the publication date [1].