CVE-2023-28771
📋 TL;DR
This vulnerability allows unauthenticated remote attackers to execute arbitrary operating system commands on affected Zyxel firewall devices by sending specially crafted IKE packets. It affects multiple Zyxel firewall product lines running vulnerable firmware versions. Attackers can potentially gain full control of affected devices without any authentication.
💻 Affected Systems
- Zyxel ZyWALL series
- Zyxel USG series
- Zyxel VPN series
- Zyxel USG FLEX series
- Zyxel ATP series
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of firewall device leading to network infiltration, data exfiltration, lateral movement into internal networks, and persistent backdoor installation.
Likely Case
Unauthenticated remote code execution allowing attackers to reconfigure firewall rules, intercept traffic, or use device as pivot point for further attacks.
If Mitigated
Limited impact if device is not internet-facing and network segmentation prevents lateral movement from compromised device.
🎯 Exploit Status
Exploit code is publicly available and actively exploited in the wild. CISA has added this to their Known Exploited Vulnerabilities catalog.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: ZyWALL/USG: 4.73 Patch 1 or later; VPN/USG FLEX/ATP: 5.36 Patch 1 or later
Vendor Advisory: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-remote-command-injection-vulnerability-of-firewalls
Restart Required: Yes
Instructions:
1. Download latest firmware from Zyxel support portal. 2. Backup current configuration. 3. Upload and install firmware update via web interface or CLI. 4. Reboot device. 5. Verify firmware version after reboot.
🔧 Temporary Workarounds
Block IKE traffic at perimeter
allTemporarily block UDP port 500 (IKE) and UDP port 4500 (IPsec NAT-T) at network perimeter to prevent exploitation attempts.
Restrict management access
allLimit management interface access to trusted IP addresses only using firewall rules.
🧯 If You Can't Patch
- Isolate affected devices in separate network segment with strict access controls
- Implement network monitoring for suspicious IKE traffic patterns and command execution attempts
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface (System > System Information) or CLI command 'show version'Check Version:
show versionVerify Fix Applied:
Verify firmware version is at least: ZyWALL/USG: 4.73 Patch 1; VPN/USG FLEX/ATP: 5.36 Patch 1📡 Detection & Monitoring
Log Indicators:
- Unusual IKE negotiation failures
- Unexpected process executions
- Configuration changes without authorized user activity
Network Indicators:
- Malformed IKE packets to UDP port 500/4500
- Outbound connections from firewall to unexpected destinations
SIEM Query:
source_ip=firewall AND (event_type="process_execution" OR event_type="configuration_change") AND user="unauthenticated"🔗 References
- http://packetstormsecurity.com/files/172820/Zyxel-IKE-Packet-Decoder-Unauthenticated-Remote-Code-Execution.html
- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-remote-command-injection-vulnerability-of-firewalls
- http://packetstormsecurity.com/files/172820/Zyxel-IKE-Packet-Decoder-Unauthenticated-Remote-Code-Execution.html
- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-remote-command-injection-vulnerability-of-firewalls
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-28771
