Vulnerability in Zyxel firewalls may soon be widely exploited (CVE-2023-28771)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-28771 | Unauthenticated OS Command Injection in Zyxel ATP, USG FLEX, VPN, and ZyWALL Firewalls CVE-2023-28771 is an unauthenticated OS command injection flaw (CWE-78) in Zyxel firewall firmware, caused by improper error message handling in the IKE packet decoder. A remote attacker triggers it by sending crafted packets to an affected device, with no credentials or user interaction required (CVSS 3.1: 9.8, network vector, low complexity). Successful exploitation lets the attacker execute operating-system commands on the firewall, which typically means full device compromise of these perimeter/VPN gateway appliances. Organizations running Zyxel ZyWALL/USG, VPN, USG FLEX, or ATP series firewalls on the affected firmware ranges are exposed, especially where IKE/VPN traffic is reachable from the internet. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV on 2023-05-31, carries a 99.3% EPSS score (100th percentile), is reportedly used by DDoS botnets, and was reportedly exploited in the May 2023 coordinated attacks against nearly two dozen Danish energy companies. Do: Apply Zyxel's patched firmware to all affected devices per the vendor advisory - releases newer than 4.73 for ZyWALL/USG and newer than 5.35 for ATP, USG FLEX, and VPN series - prioritizing internet-facing and VPN gateway appliances, as this is a KEV required-action vulnerability. Where immediate patching is not possible, restrict IKE traffic (UDP 500/4500) to trusted peers or disable unneeded IPsec VPN termination. After patching, review device logs and configurations for signs of command execution or unexpected changes, given confirmed botnet and targeted-attack use. | 9.8 | 99% | KEV PoC |
| largetens of thousands of internet-exposed Zyxel firewall/VPN gateways (order of 10,000-100,000 devices/sites); estimate | |
| CVE-2023-33010 +1 in the same advisory: …33009 | Buffer Overflow in Zyxel ATP, USG FLEX, VPN and ZyWALL/USG Firewalls Enables RCE CVE-2023-33010 is a buffer overflow (CWE-120) in the ID processing function of Zyxel's firewall firmware that is triggered when an affected device processes crafted input sent by an unauthenticated attacker. Successful exploitation can cause denial-of-service conditions and, more seriously, allow remote code execution on the firewall itself, giving an attacker a foothold at the network perimeter. The flaw affects multiple Zyxel firewall lines widely used by small and mid-sized organizations, including ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN, and legacy ZyWALL/USG models. The vulnerability has been added to CISA's Known Exploited Vulnerabilities catalog (added 2023-06-05), indicating it is being exploited in the wild, though no public proof-of-concept is known and ransomware association is unconfirmed. EPSS puts the 30-day exploitation probability at 28.8% (98th percentile), and no CVSS score has been published yet. Do: Apply the updated firmware for your specific model per Zyxel's security advisory, since the CISA required action is to patch per vendor instructions. Until patched, restrict or disable WAN-side access to the firewall's management/ID processing interfaces and monitor devices for signs of compromise such as unexpected reboots or crashes. Inventory all ATP, USG FLEX (including 50(W)), USG20(W)-VPN, VPN, and ZyWALL/USG units to confirm none remain unpatched. | 9.8 | 29% | KEV |
| large≈tens of thousands of internet-exposed devices from a combined installed base likely well over 100,000 across these firewall lines |
Full article370 words · extracted from helpnetsecurity.com · click to collapse
A recently fixed command injection vulnerability (CVE-2023-28771) affecting a variety Zyxel firewalls may soon be exploited in the wild, Rapid7 researchers have warned, after publishing a technical analysis and a PoC script that triggers the vulnerability and achieves a reverse root shell.
About CVE-2023-28771
CVE-2023-28771 affects:
- Zyxel APT, USG FLEX, and VPN firewalls running versions v4.60 to v5.35 of the ZDL firmware, and
- Zyxel ZyWALL/USG gateways/firewalls running ZLD v4.60 to v4.73
These firewall devices monitor and control network traffic, have VPN and SSL inspection capabilities, and offer additional protection against malware and other threats.
The vulnerability arises from improper error message handling, and can be triggered by sending a specially crafted UDP packet to port 500 in vulnerable devices’ WAN interface, allowing attackers to achieve OS command execution as the root user.
“The vulnerable component is the Internet Key Exchange (IKE) packet decoder, which forms part of the IPSec VPN service offered by the device,” Rapid7 researchers said, but pointed out that a VPN does not need to be configured on the device for the device to be vulnerable.
The vulnerability is easy to weaponize and successful exploitation does not hinge on prior authentication.
“CVE-2023-28771 is not known to be exploited in the wild as of May 19, 2023, though we expect this to change,” the researchers noted.
“There are some 42,000 instances of Zyxel web interfaces exposed to the public internet. This does not, however, capture vulnerable VPN implementations, which means real exposure is likely much higher.”
What should you do?
Discovered and reported by TRAPA Security researchers, the vulnerability has been fixed by Zyxel in April 2023, with the release of ZLD v5.36 and ZLD v4.73 Patch 1.
Admins of vulnerable devices are advised to upgrade to the latest firmware update as quickly as possible. Enabling automatic firmware updates is also generally a good idea.
UPDATE (May 25, 2023, 03:35 a.m. ET):
Zyxel has relased new patches to fix two buffer overflow flaws (CVE-2023-33009, CVE-2023-33010) affecting ATP, USG FLEX, USG FLEX50(W)/USG20(W)-VPN, VPN and ZyWALL/USG firewalls. These could lead to DoS or even RCE, so be sure to implement those fixes, as well.
UPDATE (May 26, 2023, 01:25 a.m. ET):
The Mirai botnet is exploiting CVE-2023-28771 en masse.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2023/05/22/cve-2023-28771/