CRITICAL

CVE-2023-28771

Zyxel Atp100 Firmware 2023-04-25 CVSS v3.1

CVSS

9.8

KEV

Description

Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, and ATP series firmware versions 4.60 through 5.35, which could allow an unauthenticated attacker to execute some OS commands remotely by sending crafted packets to an affected device.

Summary dbcve.org

Improper handling of error messages in Zyxel ZyWALL/USG, VPN, USG FLEX, and ATP series firmware allows an unauthenticated remote attacker to execute OS commands by transmitting specially crafted packets to the affected device, requiring no credentials or user interaction.

Mitigation

Upgrade affected devices to firmware versions beyond the vulnerable ranges (post-4.73 for ZyWALL/USG and post-5.35 for VPN/USG FLEX/ATP series); restrict management-plane and exposed service access via firewalling and ACLs until patches are applied.

Proof of Concept

Weakness (CWE)

CWE-78 OS Command Injection

EPSS Score

99.28%

Probability of exploitation in next 30 days

99.9th percentile

References

http://packetstormsecurity.com/files/172820/Zyxel-IKE-Packet-Decoder-Unauthenticated-Remote-Code-Execution.html Exploit, Third Party Advisory https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-remote-command-injection-vulnerability-of-firewalls Vendor Advisory https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-28771 US Government Resource

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE