QID 731221

Zyxel ATP and USG devices contain the following security vulnerabilities:

• CVE-2023-6397: A null pointer dereference vulnerability could allow a LAN-based attacker to cause denial-of-service (DoS) conditions by downloading a crafted RAR compressed file onto a LAN-side host if the firewall has the Anti-Malware feature enabled.
• CVE-2023-6398: A post-authentication command injection vulnerability in the file upload binary functionality could allow an authenticated attacker with administrator privileges to execute some operating system (OS) commands on an affected device via FTP.
• CVE-2023-6764: A format string vulnerability in a function of the IPSec VPN feature in some firewall versions could allow an attacker to achieve unauthorized remote code execution by sending a sequence of specially crafted payloads containing an invalid pointer; however, such an attack would require detailed knowledge of an affected devices memory layout and configuration.

QID Detection Logic:
This unauthenticated QID detects vulnerable Zyxel versions based on the self reported information exposed via the zld_product_spec.js source file.

NOTE: Since we currently can not detect the patch level of affected devices, this QID is potential.

Depending on the vulnerability being exploited, an unauthenticated, remote attacker could exploit these vulnerabilities to execute arbitrary code or cause a denial of service (DoS) condition on the targeted system.