Back to KEVs

CVE-2023-28771

Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG...

Basic Information

CVE State
PUBLISHED
Reserved Date
March 23, 2023
Published Date
April 25, 2023
Last Updated
February 03, 2025
Vendor
Zyxel
Product
ZyWALL/USG series firmware, VPN series firmware, USG FLEX series firmware, ATP series firmware
Description
Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, and ATP series firmware versions 4.60 through 5.35, which could allow an unauthenticated attacker to execute some OS commands remotely by sending crafted packets to an affected device.
Tags
cisa nessus_scanner edge metasploit_scanner

CVSS Scores

CVSS v3.1

9.8 - CRITICAL

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC Information

Exploitation
active
Automatable
Yes
Technical Impact
total

Exploit Status

Exploited in the Wild
Yes (2023-05-31 00:00:00 UTC) Source
Proof of Concept Available
Yes (added 2023-05-23 02:37:39 UTC) Source

References

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-remote-command-injection-vulnerability-of-firewalls http://packetstormsecurity.com/files/172820/Zyxel-IKE-Packet-Decoder-Unauthenticated-Remote-Code-Execution.html

Known Exploited Vulnerability Information

Source Added Date
CISA 2023-05-31 00:00:00 UTC

Recent Mentions

GreyNoise Observes Exploit Attempts Targeting Zyxel CVE-2023-28771

Source: GreyNoise • Published: 2025-06-16 00:00:00 UTC

‍On June 16, GreyNoise observed exploit attempts targeting CVE-2023-28771 — a remote code execution vulnerability affecting Zyxel Internet Key Exchange (IKE) packet decoders over UDP port 500.

Scanner Integrations

Scanner URL Date Detected
Metasploit https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/misc/zyxel_ike_decoder_rce_cve_2023_28771.rb 2025-04-29 11:01:18 UTC
Nessus https://www.tenable.com/plugins/nessus/176238 2023-05-23 20:04:00 UTC

Potential Proof of Concepts

Warning: These PoCs have not been tested and could contain malware. Use at your own risk.

zyxel_ike_decoder_rce_cve_2023_28771

Type: metasploit • Created: Unknown

Metasploit module for CVE-2023-28771

benjaminhays/CVE-2023-28771-PoC

Type: github • Created: 2023-05-23 02:37:39 UTC • Stars: 28

PoC for CVE-2023-28771 based on Rapid7's excellent writeup

Timeline

  • CVE ID Reserved

  • CVE Published to Public

  • Proof of Concept Exploit Available

  • Detected by Nessus

  • Added to KEVIntel

  • Detected by Metasploit