CVE-2023-33010: Zyxel firewall ID processing buffer overflow allows unauthenticated RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction, KEV-listed exploitation, and a 98th percentile EPSS score make this an urgent perimeter risk.

What it is

A classic buffer overflow (CWE-120) exists in the ID processing function of multiple Zyxel firewall firmware lines, including ATP, USG FLEX, USG20(W)-VPN, VPN and ZyWALL/USG series. An unauthenticated remote attacker can trigger denial of service and potentially execute code on the affected device, which sits at the network edge.

Impact

Successful exploitation can crash the firewall and, at worst, allow remote code execution with the privileges of the vulnerable service, giving an attacker a foothold on perimeter infrastructure.

Attack surface

The flaw is reachable over the network with no authentication and no user interaction, per the CVSS vector AV:N/AC:L/PR:N/UI:N. It is in the ID processing function, so any exposed management or service interface that reaches that code path is a candidate entry point.

Exploitation

CVE-2023-33010 is listed in CISA KEV (added 2023-06-05, due 2023-06-26), indicating known exploitation in the wild, and EPSS gives a 30-day probability of 0.28813 (98th percentile). No ransomware campaign use is recorded.

What to do

• Apply the Zyxel firmware updates referenced in the vendor security advisory for all affected ATP, USG FLEX, USG20(W)-VPN, VPN and ZyWALL/USG models.
• Restrict management and service interfaces from untrusted networks; do not expose them directly to the internet where avoidable.
• Monitor vendor advisories for follow-up patches and confirm each device's firmware version against the affected ranges.
• Where patching is delayed, isolate or segment affected firewalls and add compensating filtering for untrusted traffic to the ID processing path.

Detection

• Alert on unexpected crashes, reboots or service restarts of Zyxel firewall devices.
• Monitor for anomalous outbound connections or new processes on firewall appliances that could indicate post-exploitation activity.
• Review logs for malformed or oversized ID-related requests reaching the device from untrusted sources.
• Track firmware versions across the fleet and flag any device still in the affected ranges.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.