CVE-2023-28771
Zyxel Multiple Firewalls OS Command Injection Vulnerability
Description
CVE-2023-28771 is a critical OS command injection vulnerability affecting multiple Zyxel firewall product lines, including the ZyWALL/USG, VPN, USG FLEX, and ATP series running firmware versions 4.60 through 4.73 or 5.35 depending on the product. The vulnerability exists in the IKE packet decoder, where improper error message handling allows an unauthenticated attacker to execute arbitrary OS commands remotely by sending specially crafted packets to the device. With a CVSS score of 9.8 and an EPSS score of 94.3% (99th percentile), CVE-2023-28771 represents an exceptionally high-risk vulnerability. CISA has added this Zyxel command injection flaw to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| zyxel | atp100 firmware | >= 4.60, < 5.36 |
| zyxel | atp100w firmware | >= 4.60, < 5.35 |
| zyxel | atp200 firmware | >= 4.60, < 5.36 |
| zyxel | atp500 firmware | >= 4.60, < 5.36 |
| zyxel | atp700 firmware | >= 4.60, < 5.36 |
| zyxel | atp800 firmware | >= 4.60, < 5.36 |
| zyxel | usg flex 100 firmware | >= 4.60, < 5.36 |
| zyxel | usg flex 100w firmware | >= 4.60, < 5.36 |
| zyxel | usg flex 200 firmware | >= 4.60, < 5.36 |
| zyxel | usg flex 50 firmware | >= 4.60, < 5.36 |
| zyxel | usg flex 500 firmware | >= 4.60, < 5.36 |
| zyxel | usg flex 50w firmware | >= 4.60, < 5.36 |
| zyxel | usg flex 700 firmware | >= 4.60, < 5.36 |
| zyxel | vpn100 firmware | >= 4.60, < 5.36 |
| zyxel | vpn1000 firmware | >= 4.60, < 5.36 |
| zyxel | vpn300 firmware | >= 4.60, < 5.36 |
| zyxel | vpn50 firmware | >= 4.60, < 5.36 |
| zyxel | zywall usg 310 firmware | >= 4.60, < 4.73; 4.73 |
| zyxel | zywall usg 100 firmware | >= 4.60, < 4.73; 4.73 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/172820/Zyxel-IKE-Packet-Decoder-Unauthenticated-Remote-Code-Execution.html(Exploit, Third Party Advisory)
- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-remote-command-injection-vulnerability-of-firewalls(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-28771(US Government Resource)
Weakness Type
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
In the context of CVE-2023-28771, the Zyxel firewall firmware fails to properly sanitize input within IKE packet processing, allowing specially crafted network packets to inject OS commands that execute with the privileges of the firewall process. This OS command injection weakness enables full remote code execution on affected Zyxel devices without any authentication.
Learn more: CWE-78 — Improper Neutralization of Special Elements used in an OS Command
Impact Analysis
CVE-2023-28771 carries a CVSS v3.1 score of 9.8 (Critical), reflecting its severe exploitability profile. The vulnerability is remotely exploitable without physical access via the network attack vector, with low attack complexity meaning no special conditions or preparation are needed. No authentication is required to exploit the flaw, and no user interaction is necessary, making it fully automatable. Confidentiality, integrity, and availability impacts are all rated High, meaning a successful exploit grants the attacker complete control over the firewall device — they can read sensitive configuration data including VPN credentials, modify firewall rules to allow further intrusion, and disrupt network operations entirely. The EPSS score of 94.3% places this vulnerability in the 99th percentile, indicating near-certain exploitation activity across the internet. As a network perimeter device, a compromised Zyxel firewall gives attackers a foothold to pivot into protected internal networks.
Exploit Maturity
Public exploit code is available for CVE-2023-28771 via Packet Storm Security, providing a fully functional unauthenticated remote code execution exploit targeting the IKE packet decoder. CISA has confirmed active exploitation in the wild by adding this vulnerability to the Known Exploited Vulnerabilities catalog, with a remediation deadline of June 21, 2023. The EPSS score of 94.3% indicates near-certain exploitation activity, placing it in the 99th percentile of all scored vulnerabilities. Multiple threat actors have been observed leveraging this Zyxel firewall vulnerability in widespread scanning and exploitation campaigns targeting internet-facing devices.
Remediation
- Apply firmware updates immediately as directed by CISA's KEV required action: apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Zyxel has released patched firmware — update ZyWALL/USG series to firmware above 4.73, VPN series above 5.35, USG FLEX series above 5.35, and ATP series above 5.35 via the Zyxel security advisory.
- Restrict IKE/IPsec access by configuring firewall rules to limit IKE traffic (UDP ports 500 and 4500) to only known, trusted IP addresses. If VPN functionality is not required, disable the IKE service entirely on affected devices.
- Implement network segmentation to isolate management interfaces of Zyxel firewalls from the general internet. Place management access behind a separate, hardened jump host or VPN that is not itself vulnerable.
- Monitor for indicators of compromise by reviewing firewall logs for unexpected command execution, unusual outbound connections, or unauthorized configuration changes. Check for any signs of backdoor installation or persistent access mechanisms.
- Validate all network input handling in perimeter devices as a long-term hardening measure. Conduct regular firmware audits and subscribe to vendor security advisory notifications to ensure timely patching of OS command injection and similar vulnerabilities.
Technical Details
CVE-2023-28771 exploits an OS command injection weakness (CWE-78) in the IKE (Internet Key Exchange) packet decoder of Zyxel firewall firmware. The vulnerability arises from improper handling of error messages during IKE packet processing, where attacker-controlled data from crafted network packets is incorporated into system commands without adequate sanitization. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms that exploitation requires only network access with no authentication, no user interaction, and low complexity — an attacker simply sends malformed IKE packets to UDP port 500 on the target device. Because the IKE service runs with elevated privileges on the firewall, successful command injection yields full system-level access with the ability to read and modify configuration, intercept traffic, and disrupt operations. The vulnerability affects a broad range of Zyxel products across four firewall product lines (ZyWALL/USG, VPN, USG FLEX, and ATP) spanning multiple firmware generations from version 4.60 onward.
Frequently Asked Questions
Is CVE-2023-28771 being actively exploited?
Yes, CVE-2023-28771 is actively exploited in the wild. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of June 21, 2023. The EPSS score of 94.3% (99th percentile) further confirms widespread exploitation activity targeting Zyxel firewalls.
What products are affected by CVE-2023-28771?
CVE-2023-28771 affects multiple Zyxel firewall product lines: ZyWALL/USG series (firmware 4.60–4.73), VPN series including VPN50, VPN100, VPN300, and VPN1000 (firmware 4.60–5.35), USG FLEX series including FLEX 50, 50W, 100, 100W, 200, 500, and 700 (firmware 4.60–5.35), and ATP series including ATP100, 100W, 200, 500, 700, and 800 (firmware 4.60–5.35).
How do I fix CVE-2023-28771?
Update your Zyxel firewall firmware to the latest version above the affected ranges as specified in the Zyxel security advisory. If immediate patching is not possible, restrict IKE traffic (UDP ports 500 and 4500) to trusted IP addresses only and monitor firewall logs for signs of exploitation.
How severe is CVE-2023-28771?
CVE-2023-28771 is rated Critical with a CVSS v3.1 score of 9.8 out of 10. It requires no authentication, no user interaction, and can be exploited remotely with low complexity. The EPSS percentile of 99.9% indicates it is among the most actively exploited vulnerabilities tracked.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.