NetSight
IP …
critical9.8Known exploited

CVE-2023-28771

Zyxel Multiple Firewalls OS Command Injection Vulnerability

Exploited in the wild

This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2023-05-31. Federal due date: 2023-06-21.

Apply updates per vendor instructions.

Impact

Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, and ATP series firmware versions 4.60 through 5.35, which could allow an unauthenticated attacker to execute some OS commands remotely by sending crafted packets to an affected device.

Affected products

VendorProductAffected versions
ZyxelAtp100 Firmware
from 4.60 before 5.36
ZyxelAtp100w Firmware
from 4.60 before 5.35
ZyxelAtp200 Firmware
from 4.60 before 5.36
ZyxelAtp500 Firmware
from 4.60 before 5.36
ZyxelAtp700 Firmware
from 4.60 before 5.36
ZyxelAtp800 Firmware
from 4.60 before 5.36
ZyxelUsg Flex 100 Firmware
from 4.60 before 5.36
ZyxelUsg Flex 100w Firmware
from 4.60 before 5.36
ZyxelUsg Flex 200 Firmware
from 4.60 before 5.36
ZyxelUsg Flex 50 Firmware
from 4.60 before 5.36
ZyxelUsg Flex 500 Firmware
from 4.60 before 5.36
ZyxelUsg Flex 50w Firmware
from 4.60 before 5.36

Weakness classification

CWE-78

References