CVE-2023-6399 Denial of service in USG FLEX 50(W) series firmware

Medium 5.7 Published 20 Feb 2024 Updated 2 Aug 2024

An authenticated IPSec VPN user can cause a denial of service against the deviceid daemon by sending a crafted hostname if Device Insight is enabled.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-6399?

CVE-2023-6399 is a medium-severity denial of service vulnerability in Zyxel USG FLEX 50(W) series firmware, published on 20 Feb 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A format string vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 through 5.37 Patch 1, USG20(W)-VPN series firmware versions from 4.16 through 5.37 Patch 1, and USG FLEX H series firmware versions from 1.10 through 1.10 Patch 1 could allow an authenticated IPSec VPN user to cause DoS conditions against the “deviceid” daemon by sending a crafted hostname to an affected device if it has the “Device Insight” feature enabled.

Weakness: CWE-134

Which versions are affected by CVE-2023-6399?

It affects 22 products.

Products include Zyxel Atp100 Firmware, Zyxel Atp100w Firmware, Zyxel Atp200 Firmware, Zyxel Atp500 Firmware, Zyxel Atp700 Firmware, Zyxel Atp800 Firmware and 16 more.

How do I fix CVE-2023-6399?

No fix has been published for CVE-2023-6399 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2023-6399 being exploited?

There is no known exploitation of CVE-2023-6399 in the wild and no public exploit code.

Sources

Also known as GHSA-6mfv-h538-gwvr.