CVE-2023-28771
Zyxel Multiple Firewalls OS Command Injection Vulnerability
Zyxel · Multiple Firewalls
Vulnerability details
Zyxel ATP, USG FLEX, VPN, and ZyWALL/USG firewalls allow for improper error message handling which could allow an unauthenticated attacker to execute OS commands remotely by sending crafted packets to an affected device.
Added to CISA KEV: 2023-05-31
Ransomware campaign use: Unknown
CISA due date: 2023-06-21
Defensive guidance from CISA
Apply updates per vendor instructions.
This is the source's required-action field, not an independently validated patch procedure. Refer to the vendor for exact affected versions and fixes.
Source catalog date: 2026-11-06T19:44:45.1797Z · Last retrieved: 2026-11-06 21:02:26 UTC