A buffer overflow vulnerability in the CGI program of Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50 through V5.38, USG FLEX 50(W) series firmware versions from V4.16 through V5.38, and USG20(W)-VPN series firmware versions from V4.16 through V5.38 could allow an authenticated attacker with administrator privileges to cause denial of service (DoS) conditions by sending a crafted HTTP request to a vulnerable device.
History

Fri, 13 Dec 2024 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Zyxel zld
CPEs cpe:2.3:o:zyxel:zld_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:zyxel:zld:*:*:*:*:*:*:*:*
Vendors & Products Zyxel zld Firmware
Zyxel zld

Thu, 05 Sep 2024 15:00:00 +0000

Type Values Removed Values Added
First Time appeared Zyxel
Zyxel atp100
Zyxel atp100w
Zyxel atp200
Zyxel atp500
Zyxel atp700
Zyxel atp800
Zyxel usg 20w-vpn
Zyxel usg Flex 100
Zyxel usg Flex 100ax
Zyxel usg Flex 100w
Zyxel usg Flex 200
Zyxel usg Flex 50
Zyxel usg Flex 500
Zyxel usg Flex 50w
Zyxel usg Flex 700
Zyxel zld Firmware
CPEs cpe:2.3:h:zyxel:atp100:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:atp100w:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:atp200:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:atp500:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:atp700:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:atp800:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_20w-vpn:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_100:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_100ax:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_100w:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_200:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_500:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_50:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_50w:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_700:-:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:zld_firmware:*:*:*:*:*:*:*:*
Vendors & Products Zyxel
Zyxel atp100
Zyxel atp100w
Zyxel atp200
Zyxel atp500
Zyxel atp700
Zyxel atp800
Zyxel usg 20w-vpn
Zyxel usg Flex 100
Zyxel usg Flex 100ax
Zyxel usg Flex 100w
Zyxel usg Flex 200
Zyxel usg Flex 50
Zyxel usg Flex 500
Zyxel usg Flex 50w
Zyxel usg Flex 700
Zyxel zld Firmware

Tue, 03 Sep 2024 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Tue, 03 Sep 2024 02:00:00 +0000

Type Values Removed Values Added
Description A buffer overflow vulnerability in the CGI program of Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50 through V5.38, USG FLEX 50(W) series firmware versions from V4.16 through V5.38, and USG20(W)-VPN series firmware versions from V4.16 through V5.38 could allow an authenticated attacker with administrator privileges to cause denial of service (DoS) conditions by sending a crafted HTTP request to a vulnerable device.
Weaknesses CWE-120
References
Metrics cvssV3_1

{'score': 4.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}


cve-icon MITRE

Status: PUBLISHED

Assigner: Zyxel

Published: 2024-09-03T01:28:27.056Z

Updated: 2024-09-03T13:47:31.099Z

Reserved: 2024-06-26T03:23:36.684Z

Link: CVE-2024-6343

cve-icon Vulnrichment

Updated: 2024-09-03T13:47:27.069Z

cve-icon NVD

Status : Analyzed

Published: 2024-09-03T02:15:05.317

Modified: 2024-12-13T16:14:42.787

Link: CVE-2024-6343

cve-icon Redhat

No data.