High‑Severity OS Command Injection in Zyxel Firewalls (CVE‑2023‑28771) Threatens Network Perimeter
What It Is
A flaw in the error‑message handling of Zyxel ATP, USG FLEX, VPN, and ZyWALL/USG firewall firmware permits an unauthenticated attacker to inject and execute arbitrary operating‑system commands. The vulnerability is triggered by sending crafted network packets to the device’s management interface.
Exploitability
The vulnerability is publicly listed in the CISA Known Exploited Vulnerabilities (KEV) catalog and assigned a High severity rating. Proof‑of‑concept packet samples have been published, confirming that remote code execution can be achieved without credentials. No widespread active exploitation has been reported, but the presence in KEV indicates a credible threat.
Affected Products
- Zyxel ATP series firewalls
- Zyxel USG FLEX series firewalls
- Zyxel VPN firewalls
- Zyxel ZyWALL/USG series firewalls
Why It Matters for Compliance & Audit Readiness
From a control‑assurance perspective, this vulnerability directly undermines Access Controls and Network Perimeter Security—core components of frameworks such as NIST CSF, ISO 27001, and PCI‑DSS. Evidence of timely vendor‑management actions (patch tracking, firmware version verification) and continuous monitoring of firewall configurations is essential to demonstrate due diligence during audits. Failure to remediate can be interpreted as a lapse in the organization’s risk‑treatment process, jeopardizing the defensibility of the audit trail.
Recommended Actions
- Patch Immediately – Apply Zyxel’s security advisory firmware update that resolves CVE‑2023‑28771. Verify the installed version against the vendor’s release notes.
- Validate Configuration – Review firewall error‑handling settings and disable any unnecessary management interfaces exposed to untrusted networks.
- Enhance Logging – Enable detailed packet‑capture and command‑execution logs; forward them to a SIEM for continuous monitoring.
- Map Controls – Document the affected access‑control and perimeter‑security controls in your risk register; capture remediation evidence for audit purposes.
- Vendor Management Review – Update your vendor‑risk profile for Zyxel, noting the remediation timeline and any SLA adjustments.
- Conduct Targeted Testing – Perform a focused penetration test or vulnerability scan to confirm the fix and assess residual risk.
Source: https://nvd.nist.gov/vuln/detail/CVE-2023-28771