CVE-2023-33009: Zyxel firewall notification function buffer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or interaction required, active KEV listing, and potential remote code execution on perimeter security devices.

What it is

A buffer overflow in the notification function of multiple Zyxel firewall and VPN firmware lines (ATP, USG FLEX, USG20(W)-VPN, VPN, ZyWALL/USG) allows an unauthenticated remote attacker to crash the device or potentially execute code. Because these are edge security appliances, a compromise bypasses a core perimeter control.

Impact

An attacker can cause denial-of-service on the device and, per the advisory, may achieve remote code execution, giving full control of the firewall and the network segment behind it.

Attack surface

Reachable over the network via the notification function with no authentication and no user interaction required, per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

Listed in CISA KEV since 2023-06-05 with a 2023-06-26 remediation due date, and EPSS 30-day probability is about 0.28 (98th percentile), indicating observed exploitation activity.

What to do

• Apply the vendor firmware updates referenced in the Zyxel security advisory for all affected ATP, USG FLEX, USG20(W)-VPN, VPN, and ZyWALL/USG models.
• If immediate patching is not possible, restrict management and notification-facing access to trusted networks and disable unnecessary remote services.
• Segment or isolate unpatched firewalls from untrusted networks and monitor them as high-risk assets.
• Verify firmware versions against the advisory's fixed releases and track completion against the CISA KEV due date.

Detection

• Monitor firewall and IDS/IPS logs for crashes, unexpected reboots, or restarts of Zyxel devices.
• Alert on anomalous outbound connections or new listening services originating from the firewall itself.
• Review device logs for malformed or unusual traffic to the notification function and for post-exploitation command activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.