CVE-2023-28771

Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73,...

9.8 CriticalIn KEVPublic exploit

Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, and ATP series firmware versions 4.60 through 5.35, which could allow an unauthenticated attacker to execute some OS commands remotely by sending crafted packets to an affected device.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

99.3%Up 99.2 points since Apr 25, 2023

What each source reports

CVE List Score used 9.8

Record: CVE-2023-28771
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-78
Updated: 2026-11-02

EUVDEUVD-2023-32406 9.8

Record: EUVD-2023-32406
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-3xvp-8qg2-x43w 9.8

Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73,...

Record: GHSA-3xvp-8qg2-x43w
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-78
Updated: 2026-11-02

CISA KEV No score

Zyxel Multiple Firewalls OS Command Injection Vulnerability

Zyxel ATP, USG FLEX, VPN, and ZyWALL/USG firewalls allow for improper error message handling which could allow an unauthenticated attacker to execute OS commands remotely by sending crafted packets to an affected device.

Record: CVE-2023-28771
Weakness: CWE-78
Updated: 2026-11-02

NVD 9.8

Record: CVE-2023-28771
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-78
Updated: 2026-11-02

Affected products

Show 12 moreShow less

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Metasploit	Zyxel IKE Packet Decoder Unauthenticated Remote Code Execution	2023-03-31
PoC in GitHub	benjaminhays/CVE-2023-28771-PoC	2023-05-23
PoC in GitHub	JinParkmida/cve-2023-28771-demo	2025-07-22

History

History
Recorded	Changed	Sources
Nov 3, 2026	exploitation, exploits
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, CISA KEV, Metasploit, NVD, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-28771 is a critical vulnerability (CVSS 9.8) in Zyxel Atp Series Firmware, published April 25, 2023. CISA lists it as known to be exploited, since May 31, 2023. EUVD reports exploitation since May 31, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 99.3%, the 99th percentile. No source names a fixed version.