CVE-2023-33012

Deeper analysis

CVE-2023-33012 is a command injection vulnerability, tracked as CWE-78, residing in the configuration parser of Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through 5.36 Patch 2, USG FLEX 50(W) series firmware versions 5.10 through 5.36 Patch 2, USG20(W)-VPN series firmware versions 5.10 through 5.36 Patch 2, and VPN series firmware versions 5.00 through 5.36 Patch 2. The flaw permits injection of operating system commands through specially crafted GRE configuration data when cloud management mode is active.

An unauthenticated attacker positioned on the local network can leverage the issue without user interaction to execute arbitrary OS commands, resulting in full compromise of confidentiality, integrity, and availability on the affected device as reflected in its CVSS 3.1 score of 8.8.

Zyxel’s security advisory addresses this and related flaws in its firewall product line and directs administrators to apply the fixes provided in firmware versions up to 5.36 Patch 2 or subsequent updates that remediate the parser logic.

The associated EPSS score rose materially from a low starting value to a peak of 0.2424 on 2025-01-22 before receding to the current 0.0857, indicating that exploitation interest developed after public disclosure.