Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence

CVE-2023-33009

CriticalExploitedPublic exploit

A buffer overflow vulnerability in the notification function in Zyxel ATP series firmware versions 4.60 through 5.36 Patch 1, USG FLEX series firmware versions 4.60 through 5.36 Patch 1, USG FLEX 50(W) firmware versions 4.60 through 5.36 Patch 1, USG20(W)-VPN firmware versions…

Published May 25, 2023 · Updated Oct 21, 2025 · Also known as TR-23-0291

Key Facts

Patch immediately
  • CVE-2023-33009 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting Atp100 Firmware (Zyxel), Atp100w Firmware (Zyxel), Atp200 Firmware (Zyxel) and 22 more products.
  • It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Jun 5, 2023. Public exploit code is available.
  • EPSS estimates a 28% probability of exploitation in the next 30 days.
  • Fixed versions are available, including Atp100 Firmware 5.36, Atp100w Firmware 5.36, Atp200 Firmware 5.36.
  • Brandefense priority: patch immediately, because it is listed as exploited in the wild.

CVSS v3.1

9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS (30-day exploit likelihood)

28%

Higher than 98.0% of all scored CVEs

Exploited in the wild

Yes

4 catalog listings

Public exploit code

Available

Proof-of-concept or weaponized module

Get the full CVE-2023-33009 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

A buffer overflow vulnerability in the notification function in Zyxel ATP series firmware versions 4.60 through 5.36 Patch 1, USG FLEX series firmware versions 4.60 through 5.36 Patch 1, USG FLEX 50(W) firmware versions 4.60 through 5.36 Patch 1, USG20(W)-VPN firmware versions 4.60 through 5.36 Patch 1, VPN series firmware versions 4.60 through 5.36 Patch 1, ZyWALL/USG series firmware versions 4.60 through 4.73 Patch 1, could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and even a remote code execution on an affected device.

Known-Exploited Catalog Listings

CatalogAddedRemediation dueRansomware use
CISA KEVJun 5, 2023Jun 26, 2023Not reported
Industry KEV feedJun 5, 2023Jun 26, 2023Not reported
CIRCL KEVJun 5, 2023Jun 26, 2023Not reported
ENISA EUVDJun 5, 2023n/aNot reported

Required action: Apply updates per vendor instructions.

Affected Products

75 affected entries in total
ProductAffected versionsFixed in
Atp100 FirmwareZyxel5.36, 5.36-patch15.36
Atp100w FirmwareZyxel5.36, 5.36-patch15.36
Atp200 FirmwareZyxel5.36, 5.36-patch15.36
Atp500 FirmwareZyxel5.36, 5.36-patch15.36
Atp700 FirmwareZyxel5.36, 5.36-patch15.36
20 more affected products in the full CVE brief

Patched Releases

Atp100 Firmware

5.36

Atp100w Firmware

5.36

Atp200 Firmware

5.36

Atp500 Firmware

5.36

Atp700 Firmware

5.36

Atp800 Firmware

5.36

Usg 20w-VPN Firmware

5.36

Usg 40 Firmware

4.73

Usg 40w Firmware

4.73

Usg 60 Firmware

4.73

Usg 60w Firmware

4.73

Usg Flex 100 Firmware

5.36

Usg Flex 100w Firmware

5.36

Usg Flex 200 Firmware

5.36

Usg Flex 50 Firmware

5.36

Usg Flex 500 Firmware

5.36

Usg Flex 50w Firmware

5.36

Usg Flex 700 Firmware

5.36

Usg20-VPN Firmware

5.36

Vpn100 Firmware

5.36

Vpn1000 Firmware

5.36

Vpn300 Firmware

5.36

Vpn50 Firmware

5.36

Timeline

  1. Publicly disclosed

    May 25, 2023

  2. Added to CISA KEV

    Jun 5, 2023

  3. Added to Industry KEV feed

    Jun 5, 2023

  4. Added to CIRCL KEV

    Jun 5, 2023

  5. Added to ENISA EUVD

    Jun 5, 2023

  6. Last updated

    Oct 21, 2025

Weakness Type

  • CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

References

4 more references in the full CVE brief

FAQ

Common Questions.

Is CVE-2023-33009 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.

Request A Demo