CVE-2023-33010

What it actually does

CVE-2023-33010 is a network-exploitable buffer overflow in the ID processing function of multiple Zyxel firewall and VPN appliance firmware lines. Because the flaw is reachable without authentication and requires no user interaction, a remote attacker can send crafted input to the affected service and corrupt process memory. Successful exploitation can crash the affected process or device, causing denial of service, and may allow arbitrary code execution on the appliance with the privileges of the vulnerable process. Since these devices commonly sit at the network edge, compromise can provide an attacker with a foothold for traffic interception, configuration theft, credential exposure, persistence, or internal network pivoting.

Why it matters to the business

Affected Zyxel firewalls and VPN gateways may be disrupted or taken over remotely, creating a high-impact risk to internet connectivity, remote access, site-to-site VPNs, network segmentation, and perimeter security controls. This vulnerability is in CISA KEV and has active exploitation in the wild, with a historical federal remediation deadline of 2023-06-26, so unpatched exposed devices should be treated as urgent risk even though the issue is older. A successful compromise of a perimeter appliance can lead to broader business interruption, unauthorized access to internal systems, data exposure, and loss of trust in network security controls.

How an attack unfolds

An attacker first identifies an internet-facing Zyxel ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN series, or ZyWALL/USG device running an affected firmware version. The attacker then sends specially crafted unauthenticated network input to the vulnerable ID processing function. The malformed data overflows a buffer, corrupting memory in the target process. In less advanced attacks, this causes the appliance or service to crash and creates a denial-of-service condition. In more advanced exploitation, the attacker controls execution flow and runs code on the device, potentially modifying configuration, creating persistence, harvesting credentials or VPN material, disabling security functions, or using the firewall as a launch point into protected networks. Public reporting and KEV inclusion indicate exploitation has occurred in the wild, so exposed unpatched devices should not be assumed clean solely because they remain operational.

How to fix it

Upgrade affected Zyxel appliances to a vendor-fixed firmware release immediately. Based on the affected version ranges, appliances running ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, or VPN series firmware through 5.36 Patch 1 should be upgraded to a fixed release newer than 5.36 Patch 1, and ZyWALL/USG devices running through 4.73 Patch 1 should be upgraded to a fixed release newer than 4.73 Patch 1, following Zyxel’s model-specific advisory and firmware download guidance. If immediate upgrade is not possible, restrict exposure of management and VPN-related services to trusted IP ranges, disable unnecessary WAN-accessible services, enforce firewall rules that block untrusted access to administrative interfaces, and place vulnerable devices behind additional access controls where operationally feasible. Because the flaw can enable remote code execution, devices that were internet-exposed while vulnerable should be reviewed for compromise, and in high-risk cases rebuilt or factory-reset from trusted firmware with configurations restored only after validation.

How to confirm the fix worked

Confirm the exact model and firmware version from the appliance administrative interface or CLI and verify it is no longer within the affected ranges: ATP 4.32 through 5.36 Patch 1, USG FLEX 4.50 through 5.36 Patch 1, USG FLEX 50(W) 4.25 through 5.36 Patch 1, USG20(W)-VPN 4.25 through 5.36 Patch 1, VPN series 4.30 through 5.36 Patch 1, and ZyWALL/USG 4.25 through 4.73 Patch 1. Re-scan externally to confirm that only intended services are reachable from untrusted networks and that administrative interfaces are not exposed broadly. Review vendor release notes to verify the installed firmware includes the fix for this vulnerability. After patching, monitor for unexpected reboots, process crashes, configuration changes, new administrator accounts, modified VPN settings, and unusual outbound connections from the appliance.

Typical attack path

1. Scan the internet or target address ranges for Zyxel firewall/VPN appliance management or service interfaces.
2. Fingerprint the device model and firmware family to identify versions in the affected ranges.
3. Send a crafted unauthenticated request that reaches the vulnerable ID processing function.
4. Trigger buffer overflow memory corruption in the affected process.
5. Cause a service/device crash for denial of service or achieve remote code execution if the exploit is reliable.
6. If code execution succeeds, establish persistence, alter firewall/VPN configuration, collect credentials or configuration data, and pivot toward internal systems.

How to detect it

Look for signs of both failed and successful exploitation. Relevant sources include Zyxel appliance system logs, administrator audit logs, VPN logs, configuration-change logs, crash/reboot logs, network flow records, firewall logs, remote syslog archives, EDR/NDR telemetry, and external scanning records. Investigate unexplained reboots, watchdog resets, process crashes, high CPU or memory conditions, malformed or repeated requests from unknown internet sources, and any configuration changes near those events. For possible successful exploitation, review for newly created or modified administrator accounts, changed firewall/NAT/VPN rules, altered remote-management settings, unexpected firmware or package changes, unknown scheduled tasks or startup scripts, suspicious outbound connections from the appliance, and access to internal systems originating from the firewall/VPN device itself. Because reliable public exploit-specific indicators are limited, absence of known IoCs should not be used to rule out compromise; prioritize behavioral evidence and configuration integrity checks.

What your security team should do

• Prioritize all internet-exposed affected Zyxel firewall and VPN appliances for immediate firmware upgrade or isolation due to KEV status and active exploitation in the wild.
• Inventory Zyxel ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN series, and ZyWALL/USG devices and map each to its firmware version and external exposure.
• Block untrusted access to management interfaces and restrict VPN/firewall service exposure to required sources wherever possible.
• Review appliance logs, configuration backups, administrator accounts, VPN users, API keys, certificates, and scheduled tasks for unauthorized changes since the device was first exposed while vulnerable.
• If exploitation is suspected, preserve logs and configuration, rotate local and directory-backed credentials used by the appliance, replace VPN secrets/certificates as appropriate, and consider reimaging or factory-resetting from trusted firmware.
• Add perimeter monitoring for unexpected outbound traffic from firewall appliances, unexplained device reboots, crashes, and configuration changes.
• Treat legacy or end-of-maintenance Zyxel devices that cannot receive fixed firmware as replacement candidates rather than accepting long-term compensating controls.