CVE-2023-28771
ZY
Zyxel Multiple Firewalls
Zyxel Multiple Firewalls OS Command Injection Vulnerability
What it is
Zyxel ATP, USG FLEX, VPN, and ZyWALL/USG firewalls allow for improper error message handling which could allow an unauthenticated attacker to execute OS commands remotely by sending crafted packets to an affected device.
What to do
Apply updates per vendor instructions.
Vendor notices and references
- www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-remote-com
- nvd.nist.gov/vuln/detail/CVE-2023-28771
Description and required action as published by CISA. Full record at NVD.
Other Zyxel entries on the list
- GS1900 Series Switches Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability CVE-2026-7273 · Sep 21, 2026
- DSL CPE Devices Zyxel DSL CPE OS Command Injection Vulnerability CVE-2024-40891 · Feb 11, 2025
- DSL CPE Devices Zyxel DSL CPE OS Command Injection Vulnerability CVE-2024-40890 · Feb 11, 2025
- Multiple Firewalls Zyxel Multiple Firewalls Path Traversal Vulnerability CVE-2024-11667 · Dec 3, 2024
- EMG2926 Routers Zyxel EMG2926 Routers Command Injection Vulnerability CVE-2017-6884 · Sep 18, 2023
- P660HN-T1A Routers Zyxel P660HN-T1A Routers Command Injection Vulnerability CVE-2017-18368 · Aug 7, 2023