CVE-2023-34140

MediumCVSS 6.5

Published: 17/07/2023(UTC)Updated: 17/06/2026(UTC)Translated: 19/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

18th percentile - higher than 18% of all known CVEs

Summary

Firmware versions of Zyxel ATP, USG FLEX, USG20(W)-VPN, VPN, NXC2500, and NXC5500 contain a buffer overflow vulnerability that could allow an unauthenticated, LAN-based attacker to cause denial of service (DoS) conditions by sending a crafted request to the CAPWAP daemon.

Risk Assessment

This vulnerability could lead to significant disruptions in device operation, potentially affecting service availability within the organization.

Recommendation

It is recommended to update the firmware to the latest version to mitigate this vulnerability and to monitor network traffic for potential attack attempts.

Original NVD description (English source)

A buffer overflow vulnerability in the Zyxel ATP series firmware versions 4.32 through 5.36 Patch 2, USG FLEX series firmware versions 4.50 through 5.36 Patch 2, USG FLEX 50(W) series firmware versions 4.16 through 5.36 Patch 2, USG20(W)-VPN series firmware versions 4.16 through 5.36 Patch 2, VPN series firmware versions 4.30 through 5.36 Patch 2, NXC2500 firmware versions 6.10(AAIG.0) through 6.10(AAIG.3), and NXC5500 firmware versions 6.10(AAOS.0) through 6.10(AAOS.4), could allow an unauthenticated, LAN-based attacker to cause denial of service (DoS) conditions by sending a crafted request to the CAPWAP daemon.