CVE-2023-28771

Exploited in the wild. In CISA KEV since 2023‑05‑31. A vendor fix is available.

CVSS 3.19.8Critical EPSS percentile99th99% chance in 30 days CISA KEVListedsince 2023-05-31, due 2023-06-21
Public exploit: 1 source FixVendor fixNo build named by the sources

Published 2023-04-25Updated 2025-10-27Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check the exact Zyxel firmware/model you run (ZyWALL/USG, VPN, USG FLEX, or ATP series) and note your firmware version.
Compare your firmware version to the affected ranges listed by Zyxel and identify whether you fall within 4.60–4.73 (ZyWALL/USG), 4.60–5.35 (VPN and USG FLEX), or 4.60–5.35 (ATP series).
Upgrade to the fixed firmware version for your specific device family/model:
- ATP100: upgrade to 5.36
- ATP100w: upgrade to 5.35
- ATP200/500/700/800: upgrade to 5.36
- USG FLEX models (50/50w/100/100w/200/500): upgrade to 5.36
After upgrading, verify the device is actually running the new firmware version and re-test basic remote access/management behavior to confirm everything is functioning normally.
If you cannot upgrade right away, contact your Zyxel support channel or IT provider immediately for an interim mitigation plan and follow the vendor’s security advisory steps.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, and ATP series firmware versions 4.60 through 5.35, which could allow an unauthenticated attacker to execute some OS commands remotely by sending crafted packets to an affected device.

In plain language

Written by AI from the record

CVE-2023-28771 is a serious flaw in certain Zyxel firewall/UTM firmware versions that can let an attacker remotely run commands on your device without logging in; if you use affected Zyxel ZyWALL/USG, VPN, USG FLEX, or ATP devices, you should act immediately.

CVE-2023-28771 is an unauthenticated remote command execution issue in Zyxel ZyWALL/USG series, VPN series, USG FLEX series, and ATP series firmware; attackers can trigger it by sending crafted network packets, and it is listed in CISA KEV with a public exploit available.

If you're affected

Full device compromise
Network disruption
Ransomware pivot risk
Sensitive data theft risk

What is it

This is a security bug in certain Zyxel network firewalls/routers where specially crafted network messages can cause the device to run system commands. Think of it like leaving a “panic button” in the network interface that someone can press from the outside—without needing a username or password. If exploited, the attacker could take over the device that protects your business network.

Who is affected

This matters if you run or manage Zyxel ZyWALL/USG series, VPN series, USG FLEX series, or ATP series firewall/UTM devices with firmware versions in the affected ranges. Because the problem is reachable over the network and does not require a login, any device exposed to the internet (or other untrusted networks) is a direct risk. Treat it as a priority if the vulnerable feature is reachable from the network; the safest assumption is that internet-facing devices are reachable.

How urgent is it

This is RED because it is confirmed in CISA’s KEV (meaning it’s known to be exploited in the real world), and a public exploit is available. Attackers do not need credentials to trigger it remotely, so waiting increases the chance of compromise and network disruption.

What to do — in detail

Confirm exposure (device + firmware)
- For each Zyxel device in scope (ZyWALL/USG series, VPN series, USG FLEX series, ATP series), record:
  - Model (including ATP100/100w/200/500/700/800; USG FLEX 50/50w/100/100w/200/500)
  - Exact firmware version currently running.
- Determine if your firmware falls in the affected ranges given in the advisory description:
  - ZyWALL/USG: 4.60 through 4.73
  - VPN: 4.60 through 5.35
  - USG FLEX: 4.60 through 5.35
  - ATP: 4.60 through 5.35
Upgrade to the fixed firmware version for your model
- Use Zyxel’s documented upgrade process for your specific device.
- Fixed versions from the findings:
  - ATP100 firmware → fixed in 5.36
  - ATP100w firmware → fixed in 5.35
  - ATP200 firmware → fixed in 5.36
  - ATP500 firmware → fixed in 5.36
  - ATP700 firmware → fixed in 5.36
  - ATP800 firmware → fixed in 5.36
  - USG FLEX 100 firmware → fixed in 5.36
  - USG FLEX 100w firmware → fixed in 5.36
  - USG FLEX 200 firmware → fixed in 5.36
  - USG FLEX 50 firmware → fixed in 5.36
  - USG FLEX 500 firmware → fixed in 5.36
  - USG FLEX 50w firmware → fixed in 5.36
Verify after patching
- Confirm the device is now running the expected fixed firmware version.
- Check normal security functionality (VPN/firewall rules) to ensure the upgrade didn’t break expected behavior.
If patching is delayed
- Follow the vendor security advisory guidance for interim mitigations while upgrading.
- Reduce exposure immediately where possible (for example, restrict management and any internet-facing exposure to only what you must have), and ensure untrusted networks cannot reach the vulnerable service paths.
Why this must be treated as urgent
- CISA KEV lists this issue (added 2023-05-31) and provided a remediation due date of 2023-06-21.
- There is a public exploit, and KEV listing indicates real-world exploitation.
What to monitor
- After upgrading, watch for signs of attacker activity on the device (unexpected admin changes, unusual remote activity, or configuration changes), and review logs for suspicious network requests around the time of upgrade.

Technical context

CVE-2023-28771 is a remote command execution vulnerability driven by improper error message handling (CWE-78). The findings state that an unauthenticated attacker can execute some operating system commands remotely by sending crafted packets to affected devices.

Exploitation status and maturity:

CISA KEV confirms it is known to be exploited in the wild; CISA added it on 2023-05-31 with a remediation due date of 2023-06-21.
A public exploit is available (at least one known), increasing likelihood of follow-on attacks.

Patch availability:

Fixed firmware versions are provided by device family/model in the findings, with ATP100 requiring 5.36, ATP100w requiring 5.35, and multiple other ATP/USG FLEX models requiring 5.36.

EPSS note:

A very high EPSS was reported in the findings; however, KEV exploitation confirmation is the primary driver for urgency and is treated as fact here.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS99th

Public exploit

CISA KEV

Listed as exploited in the wild since 2023-05-31.

US federal agencies must remediate by 2023-06-21.

Apply updates per vendor instructions.

Public exploits

1 source with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

99% chance of exploitation activity in the next 30 days, which ranks it in the 99th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

The patch came 130 days before any public exploit.

2026-06-25OpenVAS check added
2026-03-06Public exploit / PoCsource: packetstorm
2025-10-27Patch availablerecord updated
2023-05-31Added to CISA KEV
2023-04-25Publishedweakness classified, att&ck mapped

Affected products

Zyxel Communications Corp.commercial · TWaka Zyxel

And 34 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable