# CVE-2023-28771

Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, and ATP series firmware versions 4.60 through 5.35, which could allow an unauthenticated attacker to execute some OS commands remotely by sending crafted packets to an affected device.

- Page: https://www.vulneraibility.com/cve/CVE-2023-28771
- CVSS: 9.8
- Known exploited: yes, in CISA KEV since 2023-05-31; CISA due date 2023-06-21
- EPSS: 99.28% (percentile 99.9)
- Public exploit code: 1 Metasploit module · 2 GitHub proofs of concept (first 2023-05-23)
- CISA SSVC: exploitation active, automatable yes, technical impact total (assessed 2023-11-18)
- Weakness: CWE-78
- Published: 2023-04-25

## Affected versions

- Zyxel ATP series firmware: affected 4.60 through 5.35
- Zyxel USG FLEX series firmware: affected 4.60 through 5.35
- Zyxel VPN series firmware: affected 4.60 through 5.35
- Zyxel ZyWALL/USG series firmware: affected 4.60 through 4.73

A version outside these ranges is not a statement that it is unaffected.

## References

- [other] https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-remote-command-injection-vulnerability-of-firewalls
- [other] http://packetstormsecurity.com/files/172820/Zyxel-IKE-Packet-Decoder-Unauthenticated-Remote-Code-Execution.html
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-28771

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.