CVE-2023-28771

Summary

Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, and ATP series firmware versions 4.60 through 5.35, which could allow an unauthenticated attacker to execute some OS commands remotely by sending crafted packets to an affected device.

Affected Software

VendorProductVersion RangeStatus
ZyxelZyWALL/USG series firmware4.60 through 4.73affected
ZyxelVPN series firmware4.60 through 5.35affected
ZyxelUSG FLEX series firmware4.60 through 5.35affected
ZyxelATP series firmware4.60 through 5.35affected

Weaknesses

  • CWE-78: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: active
    • Automatable: yes
    • Technical Impact: total

Additional References

References