CVE-2023-28771: Zyxel Multiple Firewalls OS Command Injection Vulnerability
Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, and ATP series firmware versions 4.60 through 5.35, which could allow an unauthenticated attacker to execute some OS commands remotely by sending crafted packets to an affected device.
Published Apr 25, 2023 · Updated Jun 17, 2026
Required action
Apply updates per vendor instructions.
Advisory details
From the National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, and ATP series firmware versions 4.60 through 5.35, which could allow an unauthenticated attacker to execute some OS commands remotely by sending crafted packets to an affected device.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology
More Zyxel vulnerabilities
All Zyxel entriesCVE-2026-7273
Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability
high8.8ExploitedJun 16, 2026CVE-2024-40890
Zyxel DSL CPE OS Command Injection Vulnerability
high8.8ExploitedFeb 4, 2025CVE-2024-40891
Zyxel DSL CPE OS Command Injection Vulnerability
high8.8ExploitedFeb 4, 2025CVE-2024-11667
Zyxel Multiple Firewalls Path Traversal Vulnerability
critical9.8ExploitedNov 27, 2024CVE-2023-27992
Zyxel Multiple NAS Devices Command Injection Vulnerability
critical9.8ExploitedJun 19, 2023CVE-2023-33009
Zyxel Multiple Firewalls Buffer Overflow Vulnerability
critical9.8ExploitedMay 24, 2023