Cyber Resilience

CVE-2023-6399

Medium

Published: 20 February 2024

Published
20 February 2024
Modified
21 January 2025
KEV Added
Patch
CVSS Score v3.1 5.7 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0031 54.3th percentile
Risk Priority 12 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-6399 is a medium-severity Use of Externally-Controlled Format String (CWE-134) vulnerability in Zyxel Atp100 Firmware. Its CVSS base score is 5.7 (Medium).

Operationally, ranked in the top 45.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

A format string vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 through 5.37 Patch 1, USG20(W)-VPN…

more

series firmware versions from 4.16 through 5.37 Patch 1, and USG FLEX H series firmware versions from 1.10 through 1.10 Patch 1 could allow an authenticated IPSec VPN user to cause DoS conditions against the “deviceid” daemon by sending a crafted hostname to an affected device if it has the “Device Insight” feature enabled.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

zyxel
atp100 firmware
5.37 · 5.10 — 5.37
zyxel
atp100w firmware
5.37 · 5.10 — 5.37
zyxel
atp200 firmware
5.37 · 5.10 — 5.37
zyxel
atp500 firmware
5.37 · 5.10 — 5.37
zyxel
atp700 firmware
5.37 · 5.10 — 5.37
zyxel
atp800 firmware
5.37 · 5.10 — 5.37
zyxel
usg flex 100 firmware
5.37 · 5.10 — 5.37
zyxel
usg flex 100ax firmware
5.37 · 5.10 — 5.37
zyxel
usg flex 100h firmware
5.37 · 5.10 — 5.37
zyxel
usg flex 100w firmware
5.37 · 5.10 — 5.37
+12 more product configuration(s) — see NVD for full list

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References