CVE-2023-28771.

Source-reported disclosure and enrichment record.

SEVERITY / CVSSUnscoredNo severity score in this snapshot.

EXPLOITATION STATUSCISA known exploitedAdded May 31, 2023

RECORD STATUSAwaiting NVD dataModified May 31, 2023

Disclosure summary

Zyxel ATP, USG FLEX, VPN, and ZyWALL/USG firewalls allow for improper error message handling which could allow an unauthenticated attacker to execute OS commands remotely by sending crafted packets to an affected device.

CISA remediation guidance

Apply updates per vendor instructions.

Original records & references

NIST NVD record
CVE Program record
CISA KEV catalog entry

PUBLISHED 2023-05-31T00:00:00-04:00
MODIFIED 2023-05-31T00:00:00-04:00
INGESTED 2026-10-06T11:42:58-04:00