CVSS 3.1
5.3 mediumCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HCVE-2023-6397
Medium (5.3) in zyxel. EPSS 0.3% chance of exploitation in the next 30 days.
A null pointer dereference vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1 and USG FLEX series firmware versions from 4.50 through 5.37 Patch 1 could allow a LAN-based attacker to cause denial-of-service (DoS) conditions by downloading a crafted RAR compressed file onto a LAN-side host if the firewall has the “Anti-Malware” feature enabled.
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 22% of CVEs (scores of 2026-10-31)
- CWE
- CWE-476
- Published
- Modified
- Record from
- the NVD, synced
Affected
- zyxel:atp100_firmware
- zyxel:atp100w_firmware
- zyxel:atp200_firmware
- zyxel:atp500_firmware
- zyxel:atp700_firmware
- zyxel:atp800_firmware
- zyxel:usg_flex_100_firmware
- zyxel:usg_flex_100ax_firmware
- zyxel:usg_flex_100h_firmware
- zyxel:usg_flex_100w_firmware
- zyxel:usg_flex_200_firmware
- zyxel:usg_flex_200h_firmware
- zyxel:usg_flex_200hp_firmware
- zyxel:usg_flex_500_firmware
- zyxel:usg_flex_500h_firmware
- zyxel:usg_flex_50_firmware
- zyxel:usg_flex_50w_firmware
- zyxel:usg_flex_700_firmware
- zyxel:usg_flex_700h_firmware