CVE-2023-28771
Published: 25 April 2023
Summary
CVE-2023-28771 is a critical-severity OS Command Injection (CWE-78) vulnerability in Zyxel Zywall Usg 310 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.0% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-11 (Error Handling).
Deeper analysis
CVE-2023-28771 is an improper error message handling flaw, tracked as CWE-78, that affects multiple Zyxel firewall product lines. Impacted devices include the ZyWALL/USG series running firmware 4.60 through 4.73, and the VPN, USG FLEX, and ATP series running firmware 4.60 through 5.35. The vulnerability permits unauthenticated remote code execution with a CVSS 3.1 score of 9.8.
An unauthenticated attacker can exploit the issue by sending specially crafted IKE packets to an exposed device, resulting in arbitrary OS command execution with full system privileges and no user interaction required.
Zyxel’s security advisory recommends immediate firmware upgrades to patched releases and, where upgrades are not feasible, applying the vendor-supplied workarounds. The flaw appears in CISA’s Known Exploited Vulnerabilities catalog, and its EPSS score has reached 0.9435, indicating active exploitation interest following disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-32406
Vulnerability details
Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, and ATP series firmware versions 4.60 through 5.35, which could allow an…
more
unauthenticated attacker to execute some OS commands remotely by sending crafted packets to an affected device.
- CWE(s)
- KEV Date Added
- 31 May 2023
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of all inputs (including crafted IKE packets) to block OS command injection before execution.
Explicitly addresses the root cause—improper error message handling that leaks information usable for remote command execution.
Mandates timely patching of the known command-injection flaw in the affected Zyxel firmware versions.