CVE-2023-6399

A format string vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 through 5.37 Patch 1, USG20(W)-VPN series firmware versions from 4.16 through 5.37 Patch 1, and USG FLEX H series firmware versions from 1.10 through 1.10 Patch 1 could allow an authenticated IPSec VPN user to cause DoS conditions against the “deviceid” daemon by sending a crafted hostname to an affected device if it has the “Device Insight” feature enabled.
Configurations

Configuration 1 (hide)

AND
OR cpe:2.3:o:zyxel:atp100_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:atp100_firmware:5.37:-:*:*:*:*:*:*
cpe:2.3:o:zyxel:atp100_firmware:5.37:patch1:*:*:*:*:*:*
cpe:2.3:h:zyxel:atp100:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
OR cpe:2.3:o:zyxel:atp100w_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:atp100w_firmware:5.37:-:*:*:*:*:*:*
cpe:2.3:o:zyxel:atp100w_firmware:5.37:patch1:*:*:*:*:*:*
cpe:2.3:h:zyxel:atp100w:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
OR cpe:2.3:o:zyxel:atp200_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:atp200_firmware:5.37:-:*:*:*:*:*:*
cpe:2.3:o:zyxel:atp200_firmware:5.37:patch1:*:*:*:*:*:*
cpe:2.3:h:zyxel:atp200:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
OR cpe:2.3:o:zyxel:atp500_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:atp500_firmware:5.37:-:*:*:*:*:*:*
cpe:2.3:o:zyxel:atp500_firmware:5.37:patch1:*:*:*:*:*:*
cpe:2.3:h:zyxel:atp500:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
OR cpe:2.3:o:zyxel:atp700_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:atp700_firmware:5.37:-:*:*:*:*:*:*
cpe:2.3:o:zyxel:atp700_firmware:5.37:patch1:*:*:*:*:*:*
cpe:2.3:h:zyxel:atp700:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
OR cpe:2.3:o:zyxel:atp800_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:atp800_firmware:5.37:-:*:*:*:*:*:*
cpe:2.3:o:zyxel:atp800_firmware:5.37:patch1:*:*:*:*:*:*
cpe:2.3:h:zyxel:atp800:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
OR cpe:2.3:o:zyxel:usg_flex_100_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg_flex_100_firmware:5.37:-:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg_flex_100_firmware:5.37:patch1:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_100:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
OR cpe:2.3:o:zyxel:usg_flex_100ax_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg_flex_100ax_firmware:5.37:-:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg_flex_100ax_firmware:5.37:patch1:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_100ax:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND
OR cpe:2.3:o:zyxel:usg_flex_100h_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg_flex_100h_firmware:5.37:-:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg_flex_100h_firmware:5.37:patch1:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_100h:-:*:*:*:*:*:*:*

Configuration 10 (hide)

AND
OR cpe:2.3:o:zyxel:usg_flex_100w_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg_flex_100w_firmware:5.37:-:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg_flex_100w_firmware:5.37:patch1:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_100w:-:*:*:*:*:*:*:*

Configuration 11 (hide)

AND
OR cpe:2.3:o:zyxel:usg_flex_200_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg_flex_200_firmware:5.37:-:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg_flex_200_firmware:5.37:patch1:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_200:-:*:*:*:*:*:*:*

Configuration 12 (hide)

AND
OR cpe:2.3:o:zyxel:usg_flex_200h_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg_flex_200h_firmware:5.37:-:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg_flex_200h_firmware:5.37:patch1:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_200h:-:*:*:*:*:*:*:*

Configuration 13 (hide)

AND
OR cpe:2.3:o:zyxel:usg_flex_200hp_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg_flex_200hp_firmware:5.37:-:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg_flex_200hp_firmware:5.37:patch1:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_200hp:-:*:*:*:*:*:*:*

Configuration 14 (hide)

AND
OR cpe:2.3:o:zyxel:usg_flex_500_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg_flex_500_firmware:5.37:-:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg_flex_500_firmware:5.37:patch1:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_500:-:*:*:*:*:*:*:*

Configuration 15 (hide)

AND
OR cpe:2.3:o:zyxel:usg_flex_500h_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg_flex_500h_firmware:5.37:-:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg_flex_500h_firmware:5.37:patch1:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_500h:-:*:*:*:*:*:*:*

Configuration 16 (hide)

AND
OR cpe:2.3:o:zyxel:usg_flex_700_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg_flex_700_firmware:5.37:-:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg_flex_700_firmware:5.37:patch1:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_700:-:*:*:*:*:*:*:*

Configuration 17 (hide)

AND
OR cpe:2.3:o:zyxel:usg_flex_700h_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg_flex_700h_firmware:5.37:-:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg_flex_700h_firmware:5.37:patch1:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_700h:-:*:*:*:*:*:*:*

Configuration 18 (hide)

AND
OR cpe:2.3:o:zyxel:usg_flex_50_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg_flex_50_firmware:5.37:-:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg_flex_50_firmware:5.37:patch1:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_50:-:*:*:*:*:*:*:*

Configuration 19 (hide)

AND
OR cpe:2.3:o:zyxel:usg_flex_50w_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg_flex_50w_firmware:5.37:-:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg_flex_50w_firmware:5.37:patch1:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_50w:-:*:*:*:*:*:*:*

Configuration 20 (hide)

AND
OR cpe:2.3:o:zyxel:usg20-vpn_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg20-vpn_firmware:5.37:-:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg20-vpn_firmware:5.37:patch1:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg20-vpn:-:*:*:*:*:*:*:*

Configuration 21 (hide)

AND
OR cpe:2.3:o:zyxel:usg20w-vpn_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg20w-vpn_firmware:5.37:-:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg20w-vpn_firmware:5.37:patch1:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg20w-vpn:-:*:*:*:*:*:*:*

Configuration 22 (hide)

AND
OR cpe:2.3:o:zyxel:uos:1.10:-:*:*:*:*:*:*
cpe:2.3:o:zyxel:uos:1.10:patch1:*:*:*:*:*:*
OR cpe:2.3:h:zyxel:usg_flex_100h:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_100hp:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_200h:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_200hp:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_500h:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_700h:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-02-20 02:15

Updated : 2025-01-21 18:36


NVD link : CVE-2023-6399

Mitre link : CVE-2023-6399

CVE.ORG link : CVE-2023-6399


JSON object : View

Products Affected

zyxel

  • usg_flex_100ax_firmware
  • usg_flex_700
  • atp100w
  • atp700
  • atp200_firmware
  • usg_flex_500
  • usg_flex_100_firmware
  • atp800_firmware
  • usg_flex_50
  • usg_flex_50w_firmware
  • usg20w-vpn
  • usg_flex_200
  • usg20w-vpn_firmware
  • atp500
  • atp700_firmware
  • usg_flex_100
  • usg_flex_100h
  • usg_flex_100hp
  • usg_flex_500h_firmware
  • usg_flex_100w_firmware
  • usg_flex_500h
  • usg_flex_50w
  • atp200
  • atp100_firmware
  • usg_flex_100ax
  • usg_flex_500_firmware
  • usg_flex_700_firmware
  • usg20-vpn_firmware
  • atp100
  • uos
  • usg_flex_200h
  • usg_flex_200_firmware
  • usg_flex_200h_firmware
  • usg_flex_200hp_firmware
  • atp500_firmware
  • usg_flex_200hp
  • usg_flex_50_firmware
  • atp100w_firmware
  • atp800
  • usg_flex_700h_firmware
  • usg_flex_100w
  • usg20-vpn
  • usg_flex_100h_firmware
  • usg_flex_700h
CWE
CWE-134

Use of Externally-Controlled Format String

NVD-CWE-noinfo