Description
A null pointer dereference vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1 and USG FLEX series firmware versions from 4.50 through 5.37 Patch 1 could allow a LAN-based attacker to cause denial-of-service (DoS) conditions by downloading a crafted RAR compressed file onto a LAN-side host if the firewall has the “Anti-Malware” feature enabled.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Zyxel | ATP series firmware | version 4.32 through 5.37 Patch 1 | — |
| Zyxel | USG FLEX series firmware | version 4.50 through 5.37 Patch 1 | — |
Advisories 1
- WID-SEC-2024-0421 Zyxel Firewall: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 19, 2024