{"schemaVersion":3,"id":"CVE-2023-28771","aliases":[],"status":"published","duplicateOf":null,"title":"Zyxel Multiple Firewalls OS Command Injection Vulnerability","description":"Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, and ATP series firmware versions 4.60 through 5.35, which could allow an unauthenticated attacker to execute some OS commands remotely by sending crafted packets to an affected device.","dates":{"published":"2023-04-25T00:00:00.000Z","modified":"2025-10-21T23:05:48.400Z","reserved":null,"kevAdded":["2023-05-31T00:00:00.000Z","2025-01-01T00:00:00.000Z"],"kevDue":["2023-06-21T00:00:00.000Z"]},"cvss":{"headline":{"score":9.8,"severity":"critical","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.99284,"percentile":0.99938,"severity":"critical","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.99284},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.99284,"percentile":0.99938}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.99284,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.99284,"percentile":0.99938}]},"kev":{"state":"listed","entries":[{"source":"cisa","sourceLabel":"CISA","dateAdded":"2023-05-31T00:00:00.000Z","dueDate":"2023-06-21T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"Zyxel Multiple Firewalls OS Command Injection Vulnerability","description":"Zyxel ATP, USG FLEX, VPN, and ZyWALL/USG firewalls allow for improper error message handling which could allow an unauthenticated attacker to execute OS commands remotely by sending crafted packets to an affected device.","notes":[{"type":"url","href":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-remote-command-injection-vulnerability-of-firewalls","label":"www.zyxel.com/global/…"},{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2023-28771","label":"nvd.nist.gov/vuln/detail/CVE-2023-28771"}],"vendor":"Zyxel","product":"Multiple Firewalls","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null},{"source":"circl","sourceLabel":"CIRCL","dateAdded":"2025-01-01T00:00:00.000Z","dueDate":null,"requiredAction":null,"name":null,"description":null,"notes":[],"vendor":null,"product":null,"ransomware":false,"ransomwareUse":null,"exploitationType":null}],"listedCount":2,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":true,"entry":{"source":"cisa","sourceLabel":"CISA","dateAdded":"2023-05-31T00:00:00.000Z","dueDate":"2023-06-21T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"Zyxel Multiple Firewalls OS Command Injection Vulnerability","description":"Zyxel ATP, USG FLEX, VPN, and ZyWALL/USG firewalls allow for improper error message handling which could allow an unauthenticated attacker to execute OS commands remotely by sending crafted packets to an affected device.","notes":[{"type":"url","href":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-remote-command-injection-vulnerability-of-firewalls","label":"www.zyxel.com/global/…"},{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2023-28771","label":"nvd.nist.gov/vuln/detail/CVE-2023-28771"}],"vendor":"Zyxel","product":"Multiple Firewalls","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":true,"entry":{"source":"circl","sourceLabel":"CIRCL","dateAdded":"2025-01-01T00:00:00.000Z","dueDate":null,"requiredAction":null,"name":null,"description":null,"notes":[],"vendor":null,"product":null,"ransomware":false,"ransomwareUse":null,"exploitationType":null}}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"REF_AB9207D460D1F90F","name":"Exploit Reference (packetstormsecurity.com)","source":"reference","url":"http://packetstormsecurity.com/files/172820/Zyxel-IKE-Packet-Decoder-Unauthenticated-Remote-Code-Execution.html","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"MSF_EXPLOIT_LINUX_MISC_ZYXEL_IKE_DECODER_RCE_CVE_2023_28771","name":"Zyxel IKE Packet Decoder Unauthenticated Remote Code Execution","source":"metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploit/linux/misc/zyxel_ike_decoder_rce_cve_2023_28771.rb","maturity":"weaponized","reliabilityScore":0.8333333333333334,"verified":true,"type":"remote","platforms":[],"requiresAuth":false,"exploitdb":null,"metasploit":{"fullname":"exploit/linux/misc/zyxel_ike_decoder_rce_cve_2023_28771","rank":"500","rankName":"great","postAuth":false,"check":true,"stability":["crash-service-restarts"],"sideEffects":["ioc-in-logs"],"reliability":["repeatable-session"]}}],"exploitCount":2,"weaknesses":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","description":"The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/78.html"}],"affected":[{"vendor":"zyxel","product":"atp series firmware","name":"ATP series firmware","label":"atp series firmware","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"4.60 through 5.35","noFixRecorded":false,"fixedIn":null}],"versionsText":"4.60 through 5.35","eol":null,"hubHref":"/vendor/zyxel/atp_series_firmware"},{"vendor":"zyxel","product":"atp100_firmware","name":"atp100 firmware","label":"atp100_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 4.60, < 5.36","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.60, < 5.36","eol":null,"hubHref":"/vendor/zyxel/atp100"},{"vendor":"zyxel","product":"atp100w_firmware","name":"atp100w firmware","label":"atp100w_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 4.60, < 5.35","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.60, < 5.35","eol":null,"hubHref":"/vendor/zyxel/atp100w"},{"vendor":"zyxel","product":"atp200_firmware","name":"atp200 firmware","label":"atp200_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 4.60, < 5.36","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.60, < 5.36","eol":null,"hubHref":"/vendor/zyxel/atp200"},{"vendor":"zyxel","product":"atp500_firmware","name":"atp500 firmware","label":"atp500_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 4.60, < 5.36","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.60, < 5.36","eol":null,"hubHref":"/vendor/zyxel/atp500"},{"vendor":"zyxel","product":"atp700_firmware","name":"atp700 firmware","label":"atp700_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 4.60, < 5.36","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.60, < 5.36","eol":null,"hubHref":"/vendor/zyxel/atp700"},{"vendor":"zyxel","product":"atp800_firmware","name":"atp800 firmware","label":"atp800_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 4.60, < 5.36","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.60, < 5.36","eol":null,"hubHref":"/vendor/zyxel/atp800"},{"vendor":"zyxel","product":"usg_flex_100_firmware","name":"usg flex 100 firmware","label":"usg_flex_100_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 4.60, < 5.36","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.60, < 5.36","eol":null,"hubHref":"/vendor/zyxel/usg_flex_100"},{"vendor":"zyxel","product":"usg_flex_100w_firmware","name":"usg flex 100w firmware","label":"usg_flex_100w_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 4.60, < 5.36","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.60, < 5.36","eol":null,"hubHref":"/vendor/zyxel/usg_flex_100w"},{"vendor":"zyxel","product":"usg_flex_200_firmware","name":"usg flex 200 firmware","label":"usg_flex_200_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 4.60, < 5.36","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.60, < 5.36","eol":null,"hubHref":"/vendor/zyxel/usg_flex_200"},{"vendor":"zyxel","product":"usg_flex_50_firmware","name":"usg flex 50 firmware","label":"usg_flex_50_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 4.60, < 5.36","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.60, < 5.36","eol":null,"hubHref":"/vendor/zyxel/usg_flex_50"},{"vendor":"zyxel","product":"usg_flex_500_firmware","name":"usg flex 500 firmware","label":"usg_flex_500_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 4.60, < 5.36","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.60, < 5.36","eol":null,"hubHref":"/vendor/zyxel/usg_flex_500"},{"vendor":"zyxel","product":"usg_flex_50w_firmware","name":"usg flex 50w firmware","label":"usg_flex_50w_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 4.60, < 5.36","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.60, < 5.36","eol":null,"hubHref":"/vendor/zyxel/usg_flex_50w"},{"vendor":"zyxel","product":"usg_flex_700_firmware","name":"usg flex 700 firmware","label":"usg_flex_700_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 4.60, < 5.36","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.60, < 5.36","eol":null,"hubHref":"/vendor/zyxel/usg_flex_700"},{"vendor":"zyxel","product":"usg flex series firmware","name":"USG FLEX series firmware","label":"usg flex series firmware","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"4.60 through 5.35","noFixRecorded":false,"fixedIn":null}],"versionsText":"4.60 through 5.35","eol":null,"hubHref":"/vendor/zyxel/usg_flex_series_firmware"},{"vendor":"zyxel","product":"vpn series firmware","name":"VPN series firmware","label":"vpn series firmware","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"4.60 through 5.35","noFixRecorded":false,"fixedIn":null}],"versionsText":"4.60 through 5.35","eol":null,"hubHref":"/vendor/zyxel/vpn_series_firmware"},{"vendor":"zyxel","product":"vpn100_firmware","name":"vpn100 firmware","label":"vpn100_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 4.60, < 5.36","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.60, < 5.36","eol":null,"hubHref":"/vendor/zyxel/vpn100"},{"vendor":"zyxel","product":"vpn1000_firmware","name":"vpn1000 firmware","label":"vpn1000_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 4.60, < 5.36","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.60, < 5.36","eol":null,"hubHref":"/vendor/zyxel/vpn1000"},{"vendor":"zyxel","product":"vpn300_firmware","name":"vpn300 firmware","label":"vpn300_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 4.60, < 5.36","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.60, < 5.36","eol":null,"hubHref":"/vendor/zyxel/vpn300"},{"vendor":"zyxel","product":"vpn50_firmware","name":"vpn50 firmware","label":"vpn50_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 4.60, < 5.36","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.60, < 5.36","eol":null,"hubHref":"/vendor/zyxel/vpn50"},{"vendor":"zyxel","product":"zywall_usg_100_firmware","name":"zywall usg 100 firmware","label":"zywall_usg_100_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 4.60, < 4.73","noFixRecorded":false,"fixedIn":null},{"text":"4.73","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.60, < 4.73 | 4.73","eol":null,"hubHref":"/vendor/zyxel/zywall_usg_100"},{"vendor":"zyxel","product":"zywall_usg_310_firmware","name":"zywall usg 310 firmware","label":"zywall_usg_310_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 4.60, < 4.73","noFixRecorded":false,"fixedIn":null},{"text":"4.73","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.60, < 4.73 | 4.73","eol":null,"hubHref":"/vendor/zyxel/zywall_usg_310"},{"vendor":"zyxel","product":"zywall/usg series firmware","name":"ZyWALL/USG series firmware","label":"zywall/usg series firmware","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"4.60 through 4.73","noFixRecorded":false,"fixedIn":null}],"versionsText":"4.60 through 4.73","eol":null,"hubHref":"/vendor/zyxel/zywallusg_series_firmware"}],"affectedCount":23,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-remote-command-injection-vulnerability-of-firewalls","label":"www.zyxel.com/global/…","hostname":"www.zyxel.com","tags":["Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/172820/Zyxel-IKE-Packet-Decoder-Unauthenticated-Remote-Code-Execution.html","label":"packetstormsecurity.com/files/…","hostname":"packetstormsecurity.com","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-28771","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-28771","hostname":"www.cisa.gov","tags":["Government Resource","US Government Resource"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2023-04-25T00:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"kev-added","date":"2023-05-31T00:00:00.000Z","label":"Added to CISA KEV","detail":"Zyxel Multiple Firewalls OS Command Injection Vulnerability","source":"cisa"},{"kind":"kev-due","date":"2023-06-21T00:00:00.000Z","label":"CISA remediation due","detail":"Apply updates per vendor instructions.","source":"cisa"},{"kind":"kev-added","date":"2025-01-01T00:00:00.000Z","label":"Added to CIRCL KEV","detail":"Added to the CIRCL known exploited vulnerabilities catalog.","source":"circl"},{"kind":"modified","date":"2025-10-21T23:05:48.400Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":85,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T20:59:41.568Z","stale":false,"partial":false}}