ACTIVELY EXPLOITED
CVE-2023-28771: Zyxel Multiple Firewalls OS Command Injection Vulnerability
| Vendor | Zyxel |
|---|---|
| Product | Multiple Firewalls |
| Actively exploited | Yes |
| Added to CISA KEV | 31 May 2023 |
| CISA federal deadline | 21 Jun 2023 |
| Weakness (CWE) | CWE-78 |
Required action (CISA's text)
Apply updates per vendor instructions.
Description (NVD)
Zyxel ATP, USG FLEX, VPN, and ZyWALL/USG firewalls allow for improper error message handling which could allow an unauthenticated attacker to execute OS commands remotely by sending crafted packets to an affected device.
SOURCES
Other Zyxel flaws
- CVE-2026-7273: Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability
- CVE-2024-40891: Zyxel DSL CPE OS Command Injection Vulnerability
- CVE-2024-40890: Zyxel DSL CPE OS Command Injection Vulnerability
- CVE-2024-11667: Zyxel Multiple Firewalls Path Traversal Vulnerability
- CVE-2017-6884: Zyxel EMG2926 Routers Command Injection Vulnerability
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.