CVE-2023-6764: Zyxel ATP100 Firmware

High severity, CVSS 8.1. EPSS: 0.9% chance of exploitation in the next 30 days.

A format string vulnerability in a function of the IPSec VPN feature in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 through 5.37 Patch 1, and USG20(W)-VPN series firmware versions from 4.16 through 5.37 Patch 1 could allow an attacker to achieve unauthorized remote code execution by sending a sequence of specially crafted payloads containing an invalid pointer; however, such an attack would require detailed knowledge of an affected device’s memory layout and configuration.

Affected products

  • Zyxel ATP100 Firmware: from 4.32, before 5.37 (fixed in 5.37); version 5.37 only
  • Zyxel ATP100W Firmware: from 4.32, before 5.37 (fixed in 5.37); version 5.37 only
  • Zyxel ATP200 Firmware: from 4.32, before 5.37 (fixed in 5.37); version 5.37 only
  • Zyxel ATP500 Firmware: from 4.32, before 5.37 (fixed in 5.37); version 5.37 only
  • Zyxel ATP700 Firmware: from 4.32, before 5.37 (fixed in 5.37); version 5.37 only
  • Zyxel ATP800 Firmware: from 4.32, before 5.37 (fixed in 5.37); version 5.37 only
  • Zyxel USG20-VPN Firmware: from 4.16, before 5.37 (fixed in 5.37); version 5.37 only
  • Zyxel USG20W-VPN Firmware: from 4.16, before 5.37 (fixed in 5.37); version 5.37 only
  • Zyxel Usg Flex 100 Firmware: from 4.50, before 5.37 (fixed in 5.37); version 5.37 only
  • Zyxel Usg Flex 100ax Firmware: from 4.50, before 5.37 (fixed in 5.37); version 5.37 only
  • Zyxel Usg Flex 100h Firmware: from 4.50, before 5.37 (fixed in 5.37); version 5.37 only
  • Zyxel Usg Flex 100w Firmware: from 4.50, before 5.37 (fixed in 5.37); version 5.37 only
  • Zyxel Usg Flex 200 Firmware: from 4.50, before 5.37 (fixed in 5.37); version 5.37 only
  • Zyxel Usg Flex 200h Firmware: from 4.50, before 5.37 (fixed in 5.37); version 5.37 only
  • Zyxel Usg Flex 200hp Firmware: from 4.50, before 5.37 (fixed in 5.37); version 5.37 only
  • Zyxel Usg Flex 500 Firmware: from 4.50, before 5.37 (fixed in 5.37); version 5.37 only
  • Zyxel Usg Flex 500h Firmware: from 4.50, before 5.37 (fixed in 5.37); version 5.37 only
  • Zyxel Usg Flex 50 Firmware: from 4.16, before 5.37 (fixed in 5.37); version 5.37 only
  • Zyxel Usg Flex 50w Firmware: from 4.16, before 5.37 (fixed in 5.37); version 5.37 only
  • Zyxel Usg Flex 700 Firmware: from 4.50, before 5.37 (fixed in 5.37); version 5.37 only
  • Zyxel Usg Flex 700h Firmware: from 4.50, before 5.37 (fixed in 5.37); version 5.37 only

Published 2024-02-20. Last modified 2026-06-17.