Zyxel · Multiple Firewalls
CVE-2023-28771
Zyxel Multiple Firewalls OS Command Injection Vulnerability
What it is
Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, and ATP series firmware versions 4.60 through 5.35, which could allow an unauthenticated attacker to execute some OS commands remotely by sending crafted packets to an affected device.
CISA: Zyxel ATP, USG FLEX, VPN, and ZyWALL/USG firewalls allow for improper error message handling which could allow an unauthenticated attacker to execute OS commands remotely by sending crafted packets to an affected device.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: June 21, 2023
More exploited flaws from Zyxel
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Dec 3, 2024 | Path Traversal | Multiple Firewalls | High 7.5 | 2.9% |
| Jun 5, 2023 | Buffer Overflow | Multiple Firewalls | Critical 9.8 | 28% |
| Jun 5, 2023 | Buffer Overflow | Multiple Firewalls | Critical 9.8 | 29% |
| May 16, 2022 | OS Command Injection | Multiple Firewalls | Critical 9.8 | 99.9% |
| Sep 21, 2026 | Stack-Based Buffer Overflow | GS1900 Series Switches | High 8.8 | 2.8% |
| Feb 11, 2025 | DSL CPE OS Command Injection | DSL CPE Devices | High 8.8 | 21% |
| Feb 11, 2025 | DSL CPE OS Command Injection | DSL CPE Devices | High 8.8 | 23% |
| Sep 18, 2023 | Command Injection | EMG2926 Routers | High 8.8 | 33% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.