← Vulnerability Intelligence

CVE-2023-28771

Critical 9.8 Exploited in the wild (KEV)

Confirmed active exploitation — CISA KEV catalog

Name
Zyxel Multiple Firewalls OS Command Injection Vulnerability
Added to catalog
Remediation due date (US federal)
Required action
Apply updates per vendor instructions.

Description

Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, and ATP series firmware versions 4.60 through 5.35, which could allow an unauthenticated attacker to execute some OS commands remotely by sending crafted packets to an affected device.

Metrics

CVSS 3.1
9.8 (CRITICAL) Score source: CNA CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS — exploit probability
99% (percentile: 100) as of 2 November 2026
CWE
CWE-78

Affected products

zyxel: atp100 firmware; zyxel: atp100; zyxel: atp100w firmware; zyxel: atp100w; zyxel: atp200 firmware; zyxel: atp200; zyxel: atp500 firmware; zyxel: atp500; zyxel: atp700 firmware; zyxel: atp700; zyxel: atp800 firmware; zyxel: atp800; zyxel: usg flex 100 firmware; zyxel: usg flex 100; zyxel: usg flex 100w firmware

References