CVE-2023-6399: Zyxel ATP100 Firmware

Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days.

A format string vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 through 5.37 Patch 1, USG20(W)-VPN series firmware versions from 4.16 through 5.37 Patch 1, and USG FLEX H series firmware versions from 1.10 through 1.10 Patch 1 could allow an authenticated IPSec VPN user to cause DoS conditions against the “deviceid” daemon by sending a crafted hostname to an affected device if it has the “Device Insight” feature enabled.

Affected products

  • Zyxel ATP100 Firmware: from 5.10, before 5.37 (fixed in 5.37); version 5.37 only
  • Zyxel ATP100W Firmware: from 5.10, before 5.37 (fixed in 5.37); version 5.37 only
  • Zyxel ATP200 Firmware: from 5.10, before 5.37 (fixed in 5.37); version 5.37 only
  • Zyxel ATP500 Firmware: from 5.10, before 5.37 (fixed in 5.37); version 5.37 only
  • Zyxel ATP700 Firmware: from 5.10, before 5.37 (fixed in 5.37); version 5.37 only
  • Zyxel ATP800 Firmware: from 5.10, before 5.37 (fixed in 5.37); version 5.37 only
  • Zyxel Uos: version 1.10 only
  • Zyxel USG20-VPN Firmware: from 5.10, before 5.37 (fixed in 5.37); version 5.37 only
  • Zyxel USG20W-VPN Firmware: from 5.10, before 5.37 (fixed in 5.37); version 5.37 only
  • Zyxel Usg Flex 100 Firmware: from 5.10, before 5.37 (fixed in 5.37); version 5.37 only
  • Zyxel Usg Flex 100ax Firmware: from 5.10, before 5.37 (fixed in 5.37); version 5.37 only
  • Zyxel Usg Flex 100h Firmware: from 5.10, before 5.37 (fixed in 5.37); version 5.37 only
  • Zyxel Usg Flex 100w Firmware: from 5.10, before 5.37 (fixed in 5.37); version 5.37 only
  • Zyxel Usg Flex 200 Firmware: from 5.10, before 5.37 (fixed in 5.37); version 5.37 only
  • Zyxel Usg Flex 200h Firmware: from 5.10, before 5.37 (fixed in 5.37); version 5.37 only
  • Zyxel Usg Flex 200hp Firmware: from 5.10, before 5.37 (fixed in 5.37); version 5.37 only
  • Zyxel Usg Flex 500 Firmware: from 5.10, before 5.37 (fixed in 5.37); version 5.37 only
  • Zyxel Usg Flex 500h Firmware: from 5.10, before 5.37 (fixed in 5.37); version 5.37 only
  • Zyxel Usg Flex 50 Firmware: from 5.10, before 5.37 (fixed in 5.37); version 5.37 only
  • Zyxel Usg Flex 50w Firmware: from 5.10, before 5.37 (fixed in 5.37); version 5.37 only
  • Zyxel Usg Flex 700 Firmware: from 5.10, before 5.37 (fixed in 5.37); version 5.37 only
  • Zyxel Usg Flex 700h Firmware: from 5.10, before 5.37 (fixed in 5.37); version 5.37 only

Published 2024-02-20. Last modified 2026-06-17.