CVE-2023-28770

What it actually does

CVE-2023-28770 is a remote, unauthenticated sensitive information exposure flaw in Zyxel DX5401-B0 firmware prior to V5.17(ABYO.1)C0. The vulnerable CGI component “Export_Log” and binary “zcmd” can be abused to read system files, including an encrypted file containing the device supervisor password. Although the CVSS impact is confidentiality-only, disclosure of privileged device credentials can enable follow-on administrative access, configuration theft, traffic interception, persistence, or pivoting if management interfaces are reachable.

Why it matters to the business

An internet- or network-exposed Zyxel DX5401-B0 device running vulnerable firmware may leak its highest-privilege credentials to an unauthenticated attacker. In business terms, this can result in loss of control over edge networking equipment, unauthorized configuration changes, service disruption, monitoring of network traffic, or use of the device as an entry point into the wider network. The vulnerability is weaponized and has a high EPSS score, so exposed devices should be treated as high-priority even though it is not currently listed in CISA KEV.

How an attack unfolds

An attacker first identifies a reachable Zyxel DX5401-B0 management interface running firmware prior to V5.17(ABYO.1)C0. Without needing valid credentials or user interaction, the attacker sends crafted requests to the vulnerable Export_Log CGI functionality, which invokes or interacts with zcmd in a way that permits unauthorized file access. The attacker reads sensitive system files and retrieves the encrypted store containing the supervisor password. After obtaining or deriving the supervisor credential, the attacker may log in to the device management interface, export configuration, alter DNS or routing, enable remote access, deploy persistence where possible, or use the device as a foothold for additional attacks.

How to fix it

Upgrade Zyxel DX5401-B0 firmware to V5.17(ABYO.1)C0 or later. If immediate upgrade is not possible, restrict device management access to trusted administrative networks or VPNs only, block internet access to management interfaces, disable unnecessary remote administration, and apply firewall or ACL controls to prevent untrusted access to CGI endpoints. After patching, rotate the supervisor and administrative passwords because the vulnerability can expose stored credentials. Review device configuration for unauthorized changes, remove unknown accounts or remote-management settings, and restore from a trusted baseline if compromise is suspected.

How to confirm the fix worked

Confirm every Zyxel DX5401-B0 device is running firmware V5.17(ABYO.1)C0 or later through the administrative interface, CLI, or centralized inventory. Validate that management interfaces are not reachable from the public internet and are limited to approved administrative sources. Perform an authenticated configuration review to confirm supervisor password rotation, absence of unknown accounts, and no unauthorized changes to DNS, routing, firewall, port forwarding, VPN, or remote-management settings. Where safe and authorized, use vulnerability scanning or a vendor-specific check to verify the Export_Log/zcmd exposure is no longer present.

Typical attack path

1. Scan for Zyxel DX5401-B0 devices with reachable web or management services.
2. Fingerprint firmware or infer exposure based on model-specific management responses.
3. Send unauthenticated crafted requests to the vulnerable Export_Log CGI path/functionality.
4. Use the flaw to read local system files through the zcmd-related file access behavior.
5. Retrieve the encrypted file containing the supervisor password.
6. Recover or use the disclosed supervisor credential for administrative access.
7. Change device configuration, steal network settings, create persistence, or pivot further into the network.

How to detect it

Review Zyxel device web-management, system, authentication, and configuration logs for unauthenticated or unusual access to Export_Log functionality, especially from unknown external IP addresses. Look for repeated requests to CGI endpoints, log export actions not tied to legitimate administrators, failed or successful supervisor logins shortly after such requests, and configuration changes following suspicious access. Network telemetry such as firewall, reverse proxy, NetFlow, IDS, or packet captures may show probing or requests to Zyxel management HTTP/HTTPS services and CGI paths. Forensic review should focus on unexpected supervisor authentication, configuration exports, changes to DNS/routing/firewall/NAT/VPN/remote-management settings, unknown accounts, and evidence that sensitive local files were accessed or exported. Because publicly documented exploit artifacts may vary, combine path-based searches for Export_Log and zcmd with behavioral detections for unauthenticated management access followed by privileged login or configuration modification.

• Export_Log
• zcmd
• /cgi-bin/Export_Log
• supervisor
• V5.17(ABYO.1)C0

What your security team should do

• Immediately inventory Zyxel DX5401-B0 devices and identify firmware versions prior to V5.17(ABYO.1)C0.
• Prioritize remediation for devices with internet-facing or broadly reachable management interfaces because exploitation is weaponized and EPSS is high.
• Upgrade affected devices to V5.17(ABYO.1)C0 or later, then rotate supervisor and all administrative credentials.
• Restrict management access to trusted administrative networks or VPNs and block unauthenticated access from untrusted networks.
• Review logs and configurations for evidence of Export_Log abuse, unauthorized file access, successful supervisor login, configuration export, DNS/routing changes, new remote-access settings, or unknown accounts.
• If exploitation is suspected, preserve logs and configuration snapshots, isolate the device from untrusted networks, reimage or factory reset if necessary, and restore only known-good configuration.