CVE-2023-28771

What it actually does

CVE-2023-28771 is an unauthenticated remote OS command injection vulnerability in Zyxel firewall and VPN firmware caused by improper handling of error messages. A crafted packet sent over the network can cause attacker-controlled input to be passed into command execution paths on the appliance. The attack is network-reachable, low-complexity, requires no credentials or user interaction, and can result in full confidentiality, integrity, and availability impact on affected devices. Impacted firmware ranges include ZyWALL/USG 4.60 through 4.73 and VPN, USG FLEX, and ATP 4.60 through 5.35.

Why it matters to the business

This vulnerability affects perimeter security appliances that often terminate VPNs, enforce firewall policy, and sit directly on the internet. Successful exploitation can give an attacker control of the device, allowing service disruption, traffic interception or manipulation, pivoting into internal networks, credential theft from VPN/firewall configurations, and deployment of botnet or backdoor tooling. The risk is urgent: it has a CVSS score of 9.8, very high EPSS likelihood, is listed in CISA KEV with a remediation due date of 2023-06-21, and has been actively exploited in the wild for an extended period.

How an attack unfolds

An attacker scans the internet for exposed Zyxel ZyWALL/USG, VPN, USG FLEX, or ATP appliances running affected firmware. The attacker sends specially crafted network packets to the vulnerable service; because the flaw is in improper error message handling, attacker-controlled input can be interpreted as operating-system command content. No authentication, user interaction, or prior foothold is required. If exploitation succeeds, the device executes commands with elevated appliance context, enabling the attacker to run shell commands, download malware, alter configuration, create persistence, disrupt services, or use the firewall/VPN device as a staging point into protected networks. Public exploitation has been observed, and the vulnerability is present in CISA KEV, so exploitation should be assumed realistic for any internet-exposed unpatched device.

How to fix it

Upgrade affected Zyxel appliances to the vendor-fixed firmware for the specific product line and model. The vulnerable ranges include ZyWALL/USG firmware 4.60 through 4.73 and VPN, USG FLEX, and ATP firmware 4.60 through 5.35. If an immediate upgrade is not possible, reduce exposure by restricting management and VPN-related access to trusted source IPs where operationally feasible, blocking unnecessary inbound access, disabling unused VPN/IKE services, and placing additional upstream filtering in front of the device. Because this issue is actively exploited, mitigation should be treated as temporary only. After patching, rotate local administrator credentials, VPN pre-shared keys, API keys, certificates, and any secrets stored on or passing through the appliance if compromise cannot be ruled out. Review and restore known-good firewall, NAT, VPN, and routing configurations from trusted backups, and consider factory reset or device replacement for appliances with evidence of compromise.

How to confirm the fix worked

Confirm all affected appliances are running vendor-fixed firmware newer than the vulnerable ranges for their model family. Validate by checking the firmware version in the device administrative interface or CLI and comparing it with Zyxel’s advisory for the exact model. Externally verify that only required services are reachable and that management interfaces are not exposed to untrusted networks. Run authenticated configuration reviews to confirm no unauthorized administrator accounts, startup tasks, VPN profiles, firewall rules, NAT rules, routing changes, or suspicious files remain. Use vulnerability scanners or safe external assessment tools capable of detecting CVE-2023-28771 exposure, but avoid running destructive proof-of-concept commands against production appliances. After remediation, confirm SIEM/IDS coverage for UDP/500 and UDP/4500 exploit attempts and monitor for unexpected outbound connections from the appliance.

Typical attack path

1. Identify internet-exposed Zyxel ZyWALL/USG, VPN, USG FLEX, or ATP devices through scanning or asset search engines.
2. Fingerprint the appliance model and firmware exposure using network banners, service behavior, or exploit probes.
3. Send crafted packets to the vulnerable service to trigger improper error handling and inject operating-system commands.
4. Execute initial commands to confirm code execution and gather device context such as user, firmware version, interfaces, and routing information.
5. Download or stage tooling using built-in utilities such as wget, curl, busybox, or shell redirection if available.
6. Establish persistence or remote access by modifying startup scripts, enabling services, creating accounts, or deploying malware.
7. Alter firewall, VPN, NAT, or routing configuration to support access, evasion, traffic interception, or lateral movement.
8. Use the compromised perimeter device to pivot toward internal systems or to participate in botnet, proxy, scanning, or denial-of-service activity.

How to detect it

Review perimeter firewall/VPN telemetry, device logs, configuration change history, and network flow data for evidence of unauthenticated crafted IKE/IPsec traffic followed by unexpected shell command execution, outbound downloads, new processes, or configuration changes. Prioritize internet-facing Zyxel ZyWALL/USG, VPN, USG FLEX, and ATP devices running vulnerable firmware. Look for unusual UDP/500 or UDP/4500 traffic patterns from unknown external IPs, especially bursts followed by outbound HTTP/HTTPS/TFTP connections from the appliance, DNS lookups for unfamiliar domains, or connections to known scanning/botnet infrastructure. On the appliance, inspect logs for administrative account creation, unexplained VPN/firewall rule changes, unexpected reboots, firmware downgrade attempts, cron/startup persistence, suspicious temporary files, and evidence of command-line utilities such as wget, curl, busybox, telnetd, nc, or sh being invoked. Because appliance logging may be limited and attackers may clear logs, supplement with upstream NetFlow, firewall logs, IDS/IPS alerts, EDR/NDR telemetry, and configuration backups. Treat any exposed vulnerable device as potentially compromised if it was reachable from the internet before patching, and consider forensic capture or replacement if signs of compromise are found.

• UDP/500 traffic to Zyxel appliance from untrusted internet sources followed by outbound connections from the appliance
• UDP/4500 traffic to Zyxel appliance from untrusted internet sources followed by outbound connections from the appliance
• wget
• curl
• busybox
• /tmp/
• /var/tmp/
• telnetd
• nc
• netcat
• /bin/sh
• /bin/ash
• chmod +x
• crontab
• iptables
• reboot
• firmware upgrade
• firmware downgrade

What your security team should do

• Immediately inventory all Zyxel ZyWALL/USG, VPN, USG FLEX, and ATP appliances and identify firmware versions exposed to the internet.
• Patch or replace vulnerable devices as the top priority, especially any running ZyWALL/USG 4.60-4.73 or VPN/USG FLEX/ATP 4.60-5.35 firmware.
• Treat CISA KEV status and the missed 2023-06-21 due date as an escalation trigger for emergency remediation and executive visibility.
• If the device was internet-facing while vulnerable, perform compromise assessment rather than assuming patching alone is sufficient.
• Restrict inbound access to only required services and trusted source networks; disable unused VPN/IKE and management services.
• Collect and preserve device logs, configuration backups, NetFlow, and upstream firewall/IDS logs before rebooting or factory resetting suspected compromised appliances.
• Rotate administrative credentials, VPN credentials, pre-shared keys, and certificates after patching or rebuilding devices.
• Review firewall, NAT, routing, VPN, and administrator account configurations for unauthorized changes.
• Add IDS/IPS and SIEM detections for anomalous UDP/500 and UDP/4500 probes, unexpected outbound downloads from appliances, and command-execution artifacts.
• For high-risk or confirmed-compromised appliances, rebuild from trusted firmware and configuration backups or replace the device.