CVE-2023-28771

This is a security bug in certain Zyxel network firewalls/routers where specially crafted network messages can cause the device to run system commands. Think of it like leaving a “panic button” in the network interface that someone can press from the outside—without needing a username or password. If exploited, the attacker could take over the device that protects your business network.

This matters if you run or manage Zyxel ZyWALL/USG series, VPN series, USG FLEX series, or ATP series firewall/UTM devices with firmware versions in the affected ranges. Because the problem is reachable over the network and does not require a login, any device exposed to the internet (or other untrusted networks) is a direct risk. Treat it as a priority if the vulnerable feature is reachable from the network; the safest assumption is that internet-facing devices are reachable.

This is RED because it is confirmed in CISA’s KEV (meaning it’s known to be exploited in the real world), and a public exploit is available. Attackers do not need credentials to trigger it remotely, so waiting increases the chance of compromise and network disruption.

1. Confirm exposure (device + firmware)

   • For each Zyxel device in scope (ZyWALL/USG series, VPN series, USG FLEX series, ATP series), record:
     • Model (including ATP100/100w/200/500/700/800; USG FLEX 50/50w/100/100w/200/500)
     • Exact firmware version currently running.
   • Determine if your firmware falls in the affected ranges given in the advisory description:
     • ZyWALL/USG: 4.60 through 4.73
     • VPN: 4.60 through 5.35
     • USG FLEX: 4.60 through 5.35
     • ATP: 4.60 through 5.35

2. Upgrade to the fixed firmware version for your model

   • Use Zyxel’s documented upgrade process for your specific device.
   • Fixed versions from the findings:
     • ATP100 firmware → fixed in 5.36
     • ATP100w firmware → fixed in 5.35
     • ATP200 firmware → fixed in 5.36
     • ATP500 firmware → fixed in 5.36
     • ATP700 firmware → fixed in 5.36
     • ATP800 firmware → fixed in 5.36
     • USG FLEX 100 firmware → fixed in 5.36
     • USG FLEX 100w firmware → fixed in 5.36
     • USG FLEX 200 firmware → fixed in 5.36
     • USG FLEX 50 firmware → fixed in 5.36
     • USG FLEX 500 firmware → fixed in 5.36
     • USG FLEX 50w firmware → fixed in 5.36

3. Verify after patching

   • Confirm the device is now running the expected fixed firmware version.
   • Check normal security functionality (VPN/firewall rules) to ensure the upgrade didn’t break expected behavior.

4. If patching is delayed

   • Follow the vendor security advisory guidance for interim mitigations while upgrading.
   • Reduce exposure immediately where possible (for example, restrict management and any internet-facing exposure to only what you must have), and ensure untrusted networks cannot reach the vulnerable service paths.

5. Why this must be treated as urgent

   • CISA KEV lists this issue (added 2023-05-31) and provided a remediation due date of 2023-06-21.
   • There is a public exploit, and KEV listing indicates real-world exploitation.

6. What to monitor

   • After upgrading, watch for signs of attacker activity on the device (unexpected admin changes, unusual remote activity, or configuration changes), and review logs for suspicious network requests around the time of upgrade.

CVE-2023-28771 is a remote command execution vulnerability driven by improper error message handling (CWE-78). The findings state that an unauthenticated attacker can execute some operating system commands remotely by sending crafted packets to affected devices.

Exploitation status and maturity:

• CISA KEV confirms it is known to be exploited in the wild; CISA added it on 2023-05-31 with a remediation due date of 2023-06-21.
• A public exploit is available (at least one known), increasing likelihood of follow-on attacks.

Patch availability:

• Fixed firmware versions are provided by device family/model in the findings, with ATP100 requiring 5.36, ATP100w requiring 5.35, and multiple other ATP/USG FLEX models requiring 5.36.

EPSS note:

• A very high EPSS was reported in the findings; however, KEV exploitation confirmation is the primary driver for urgency and is treated as fact here.