{"id":"CVE-2023-28771","aliases":["EUVD-2023-32406","GHSA-3xvp-8qg2-x43w"],"status":"published","title":"Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73,...","description":"Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, and ATP series firmware versions 4.60 through 5.35, which could allow an unauthenticated attacker to execute some OS commands remotely by sending crafted packets to an affected device.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.99284,"percentile":0.99937,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-78"],"published":"2023-04-25T00:00:00Z","modified":"2026-06-17T05:48:44Z","kev":{"date_added":"2023-05-31","due_date":"2023-06-21","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2023-05-31"},{"source":"kev","since":"2023-05-31"}],"exploits":[{"source":"metasploit","id":"exploit/linux/misc/zyxel_ike_decoder_rce_cve_2023_28771","title":"Zyxel IKE Packet Decoder Unauthenticated Remote Code Execution","type":"exploit","platform":"Linux,Unix","date":"2023-03-31","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/misc/zyxel_ike_decoder_rce_cve_2023_28771"},{"source":"pocgithub","id":"benjaminhays/CVE-2023-28771-PoC","title":"benjaminhays/CVE-2023-28771-PoC","date":"2023-05-23","url":"https://github.com/benjaminhays/CVE-2023-28771-PoC"},{"source":"pocgithub","id":"JinParkmida/cve-2023-28771-demo","title":"JinParkmida/cve-2023-28771-demo","date":"2025-07-22","url":"https://github.com/JinParkmida/cve-2023-28771-demo"}],"products":[{"vendor":"zyxel","product":"atp series firmware"},{"vendor":"zyxel","product":"atp100_firmware"},{"vendor":"zyxel","product":"atp100w_firmware"},{"vendor":"zyxel","product":"atp200_firmware"},{"vendor":"zyxel","product":"atp500_firmware"},{"vendor":"zyxel","product":"atp700_firmware"},{"vendor":"zyxel","product":"atp800_firmware"},{"vendor":"zyxel","product":"multiple firewalls"},{"vendor":"zyxel","product":"usg flex series firmware"},{"vendor":"zyxel","product":"usg_flex_100_firmware"},{"vendor":"zyxel","product":"usg_flex_100w_firmware"},{"vendor":"zyxel","product":"usg_flex_200_firmware"},{"vendor":"zyxel","product":"usg_flex_500_firmware"},{"vendor":"zyxel","product":"usg_flex_50_firmware"},{"vendor":"zyxel","product":"usg_flex_50w_firmware"},{"vendor":"zyxel","product":"usg_flex_700_firmware"},{"vendor":"zyxel","product":"vpn series firmware"},{"vendor":"zyxel","product":"vpn1000_firmware"},{"vendor":"zyxel","product":"vpn100_firmware"},{"vendor":"zyxel","product":"vpn300_firmware"},{"vendor":"zyxel","product":"vpn50_firmware"},{"vendor":"zyxel","product":"zywall/usg series firmware"},{"vendor":"zyxel","product":"zywall_usg_100_firmware"},{"vendor":"zyxel","product":"zywall_usg_310_firmware"}],"references":[{"url":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-remote-command-injection-vulnerability-of-firewalls","tags":["x_transferred","Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/172820/Zyxel-IKE-Packet-Decoder-Unauthenticated-Remote-Code-Execution.html","tags":["x_transferred","Exploit","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-28771","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-28771"},{"url":"https://github.com/advisories/GHSA-3xvp-8qg2-x43w"}],"sources":{"cve":[{"id":"CVE-2023-28771","description":"Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, and ATP series firmware versions 4.60 through 5.35, which could allow an unauthenticated attacker to execute some OS commands remotely by sending crafted packets to an affected device.","status":"published","published":"2023-04-25T00:00:00Z","modified":"2025-10-21T23:05:48.4Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:35:32.752775Z"}],"euvd":[{"id":"EUVD-2023-32406","description":"Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, and ATP series firmware versions 4.60 through 5.35, which could allow an unauthenticated attacker to execute some OS commands remotely by sending crafted packets to an affected device.","status":"published","published":"2023-04-25T00:00:00Z","modified":"2025-10-21T23:05:48Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2023-05-31","updated_at":"2026-11-02T20:31:27.312976Z"}],"ghsa":[{"id":"GHSA-3xvp-8qg2-x43w","title":"Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73,...","description":"Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, and ATP series firmware versions 4.60 through 5.35, which could allow an unauthenticated attacker to execute some OS commands remotely by sending crafted packets to an affected device.","status":"published","published":"2023-04-25T03:30:15Z","modified":"2025-10-22T00:32:44Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:04:06.493434Z"}],"kev":[{"id":"CVE-2023-28771","title":"Zyxel Multiple Firewalls OS Command Injection Vulnerability","description":"Zyxel ATP, USG FLEX, VPN, and ZyWALL/USG firewalls allow for improper error message handling which could allow an unauthenticated attacker to execute OS commands remotely by sending crafted packets to an affected device.","cwes":["CWE-78"],"kev":{"date_added":"2023-05-31","due_date":"2023-06-21","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2023-28771","description":"Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, and ATP series firmware versions 4.60 through 5.35, which could allow an unauthenticated attacker to execute some OS commands remotely by sending crafted packets to an affected device.","status":"published","published":"2023-04-25T02:15:08.743Z","modified":"2026-06-17T05:48:44.217Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:07:56.683259Z"}]}}