CVE-2023-28771: Zyxel Multiple Firewalls OS Command Injection Vulnerability

CVE-2023-28771 is an OS command injection vulnerability affecting multiple Zyxel firewalls, including ATP, USG FLEX, VPN, and ZyWALL/USG models. It stems from improper error message handling that can let an unauthenticated attacker execute operating system commands remotely by sending crafted packets to an affected device. This matters because these appliances often sit at the network edge; successful exploitation can give an attacker a foothold to pivot, alter security policy, or move laterally into internal systems.

Defenders should treat perimeter firewalls as high-value targets and confirm exposure against the vendor advisory rather than relying on incomplete public details.

How it works

The weakness is classified as CWE-78 (OS Command Injection). In this case, the CISA summary states that improper error message handling on the listed Zyxel firewalls allows an unauthenticated remote attacker to execute OS commands by sending crafted packets to an affected device. Command injection of this class typically occurs when user-controlled input reaches a system shell or command interpreter without adequate sanitization or escaping; here the trigger is tied to error-message processing rather than a more common web parameter. An attacker who can reach the vulnerable service can therefore inject and run arbitrary commands with the privileges of the affected process. Exact packet formats, protocol details, or required conditions are not provided in the available facts and must be confirmed against the vendor advisory; do not assume public proof-of-concept code is complete or safe to test in production.

Am I affected? How to find it in your systems

The vulnerability impacts Zyxel ATP, USG FLEX, VPN, and ZyWALL/USG firewalls. These devices commonly appear as edge or branch firewalls, VPN gateways, or unified threat management appliances in enterprise and SMB environments. Inventory steps include:

• Query asset management, network discovery, or configuration management databases for any Zyxel firewall models matching the families named above.
• Log into each device (or use centralized management) and record the exact firmware or software version; compare those versions only against the vendor advisory for CVE-2023-28771, because specific affected ranges are not listed in the facts provided here.
• Check whether management or VPN interfaces are reachable from untrusted networks; the attack requires the ability to send packets to the device.
• Review device logs and any SIEM telemetry for anomalous packets, unexpected error-message generation, or signs of command execution (for example, unusual process starts or configuration changes). Absence of such logs does not prove safety, because exploitation may leave limited traces.

If you cannot determine the precise version or configuration, treat the device as potentially affected until the vendor advisory confirms otherwise.

How to remediate

The primary remediation is to apply the updates published by Zyxel according to the vendor instructions, as directed by CISA. Download firmware only from official Zyxel channels, verify integrity if hashes are supplied, and follow the vendor’s upgrade procedure for each model family (ATP, USG FLEX, VPN, ZyWALL/USG). After patching:

• Reboot or reload as required and confirm the new version is running.
• Re-validate that management interfaces remain restricted and that any temporary work-arounds are removed.
• Test basic firewall, VPN, and logging functions to ensure the update did not introduce operational regressions.

For this class of OS command injection, also review any custom scripts or external integrations that interact with the firewall’s error-handling paths and ensure they do not re-introduce unsanitized input.

If you can't patch immediately

Until the vendor update can be applied, reduce exposure with compensating controls:

• Segment the management and VPN interfaces so they are reachable only from trusted administrative networks or jump hosts; block unsolicited inbound packets from the internet or untrusted zones.
• If the product supports it, disable any non-essential services or features that process external packets and generate error messages; confirm the exact feature set against the vendor documentation.
• Deploy network-based virtual patching or IPS/WAF rules that can detect or drop anomalous packets matching the general pattern of command-injection attempts against the device, while recognizing that signature coverage may be incomplete.
• Increase monitoring: forward firewall logs to a SIEM, alert on unexpected process activity or configuration changes, and watch for outbound connections that could indicate post-exploitation command-and-control.
• Limit the privileges of any accounts used for device management and enforce multi-factor authentication where supported.

These measures lower risk but do not eliminate it; schedule the official patch as soon as operationally feasible.

If your data may have been exposed

Actively exploited remote-code-execution flaws on perimeter devices can lead to full compromise and subsequent data exposure. Known ransomware use of this specific CVE is not documented in the available facts, yet any successful command execution still warrants a thorough incident review. Check device logs for signs of unauthorized access, rotate credentials that may have been present on the appliance, and examine connected systems for lateral movement. As a quick additional check, you can run a free exposure scan of your email addresses against known breach data sets to see whether related credentials have already appeared in public dumps.