CVE-2023-28769

CRITICAL

Zyxel dx5401-b0_firmware Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Title source: VulnCheck
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2023-28769 has a selected CVSS score of 9.8 (critical); EIP currently links 1 catalogued exploit.

Description

The buffer overflow vulnerability in the library “libclinkc.so” of the web server “zhttpd” in Zyxel DX5401-B0 firmware versions prior to V5.17(ABYO.1)C0 could allow a remote unauthenticated attacker to execute some OS commands or to cause denial-of-service (DoS) conditions on a vulnerable device.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Nov 1, 2024 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Catalogued exploits
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 31, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

DX5401-B0 firmware

Browse Zyxel / DX5401-B0 firmware
CVE List, VulnCheck< V5.17(ABYO.1)C0affected

Proofs of concept

1

Catalogued exploits

MetasploitZyxel Unauthenticated LAN Remote Code ExecutionMetasploit exploitby Gerhard Hechenberger <g.hechenberger@sec-consult.com> +4 moreNot analyzed1 file

Ruby

Metasploit
PoC details

References

2