ZeroDay Findings
Sign inSign up

Findings

CVE-2023-28771

Zyxel Multiple Firewalls OS Command Injection Vulnerability

Published Apr 24, 2023 · updated Jun 16, 2026 · zyxel atp100 firmware

Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, and ATP series firmware versions 4.60 through 5.35, which could allow an unauthenticated attacker to execute some OS commands remotely by sending crafted packets to an affected device.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 24, 2023 · Catalog

    Detected

    Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, and ATP series firmware versions 4.60 through 5.35, which could allow an unauthenticated attacker to execute some OS commands remotely by sending crafted packets to an affected device.

  2. May 31, 2023 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Jun 21, 2023 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, and ATP series firmware versions 4.60 through 5.35, which could allow an unauthenticated attacker to execute some OS commands remotely by sending crafted packets to an affected device.

Required action

Apply updates per vendor instructions.

CISA due date Jun 21, 2023

Affected

  • cpe zyxel/atp100 firmwareversion unspecified
  • cpe zyxel/atp100w firmwareversion unspecified
  • cpe zyxel/atp200 firmwareversion unspecified
  • cpe zyxel/atp500 firmwareversion unspecified
  • cpe zyxel/atp700 firmwareversion unspecified
  • cpe zyxel/atp800 firmwareversion unspecified
  • cpe zyxel/usg flex 100 firmwareversion unspecified
  • cpe zyxel/usg flex 100w firmwareversion unspecified
  • cpe zyxel/usg flex 200 firmwareversion unspecified
  • cpe zyxel/usg flex 50 firmwareversion unspecified
  • cpe zyxel/usg flex 500 firmwareversion unspecified
  • cpe zyxel/usg flex 50w firmwareversion unspecified
  • vendor Zyxel Multiple Firewallsversion unspecified

Sources

  • CISA KEVCVE-2023-28771

    Zyxel ATP, USG FLEX, VPN, and ZyWALL/USG firewalls allow for improper error message handling which could allow an unauthenticated attacker to execute OS commands remotely by sending crafted packets to an affected device.

    cisa.gov
  • CVE.orgCVE-2023-28771

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2023-28771

    30-day exploitation probability 99.3%

    first.org
  • Metasploit Modulesexploit_linux/misc/zyxel_ike_decoder_rce_cve_2023_28771

    Public module reference (great). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2023-28771

    Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, and ATP series firmware versions 4.60 through 5.35, which could allow an unauthenti

    nvd.nist.gov
  • Packet Storm Securityhttp://packetstormsecurity.com/files/172820/Zyxel-IKE-Packet-Decoder-Unauthenticated-Remote-Code-Execution.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com

References