CVE-2023-28771criticalunder attackCWE-78

CVE-2023-28771: critical vulnerability in Zyxel ZyWALL/USG series firmware

Published · Updated

Follow this CVE+ Monitor USG FLEX series+ Monitor ATP series

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 99%
from disclosure to weapon28 days
Published on NVDApr 25
1st PoC+28d
metasploitMar 31
CISA KEV+36d
Action required by CISAfederal deadline: 2023-06-21

Apply updates per vendor instructions.

In short

A flaw in Zyxel firewalls allows attackers to run system commands on the device without logging in, by sending specially crafted packets. This is critical because it gives complete control over the affected firewall.

Technical detail

CWE-78 (OS Command Injection) via improper error message handling in Zyxel ZyWALL/USG/VPN/USG FLEX/ATP firmware versions 4.60–5.35. Unauthenticated remote attacker can inject OS commands through crafted network packets, resulting in arbitrary code execution with device privileges.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, and ATP series firmware versions 4.60 through 5.35, which could allow an unauthenticated attacker to execute some OS commands remotely by sending crafted packets to an affected device.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Zyxel · ATP series firmwareZyxel · USG FLEX series firmwareZyxel · VPN series firmwareZyxel · ZyWALL/USG series firmware
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Zyxel ZyWALL/USG series firmware

In the same product, most dangerous first.

CVE-2022-30525CRITICALCVE-2022-30525EPSS 99.9%KEVCVE-2023-33010CRITICALCVE-2023-33010EPSS 29.0%KEVCVE-2023-33009CRITICALCVE-2023-33009EPSS 28.1%KEVCVE-2024-11667HIGHCVE-2024-11667EPSS 3.0%KEVCVE-2022-0342CRITICALCVE-2022-0342EPSS 95.1%CVE-2023-33012HIGHCVE-2023-33012EPSS 9.9%