CVE-2023-33011

Vulnerability

A format string vulnerability exists in the PPPoE configuration handling of Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through 5.36 Patch 2, USG FLEX 50(W) series firmware versions 5.10 through 5.36 Patch 2, USG20(W)-VPN series firmware versions 5.10 through 5.36 Patch 2, and VPN series firmware versions 5.00 through 5.36 Patch 2 [1]. The vulnerability, identified as CVE-2023-33011, is triggered when the cloud management mode is enabled on the affected device [1].

Exploitation

An unauthenticated attacker with LAN access can exploit this vulnerability by sending a crafted PPPoE configuration to the affected device [1]. The attacker does not require authentication but needs to be on the same local network segment as the firewall. The vulnerable code path processes the PPPoE configuration string without proper sanitization, allowing the attacker to include format string specifiers that lead to arbitrary OS command execution [1]. No user interaction is required; the attack can be performed remotely from within the LAN.

Impact

Successful exploitation allows the attacker to execute arbitrary OS commands on the affected firewall device [1]. This gives the attacker complete control over the firewall, enabling actions such as modifying firewall rules, exfiltrating network data, installing persistent malware, or pivoting to other internal systems. The compromise impacts all three pillars of security (confidentiality, integrity, and availability) and grants the attacker root-level privileges on the device.

Mitigation

Zyxel released patches for all affected firmware versions. Users should update to the latest firmware versions provided in the Zyxel security advisory [1]. The advisory does not list specific fixed version numbers, but users are instructed to install the latest available firmware for their device series [1]. No workarounds are provided; the only complete mitigation is to disable cloud management mode or apply the firmware update. This CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as of the publication date.