Critical 9.8Known exploited (CISA KEV)Published Apr 24, 2023

CVE-2023-28771Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, an…

Updated under an hour ago (Oct 26, 2026, 11:40 PM ET)

Does this affect you?

It affects Zyxel ZyWALL/USG series firmware and 22 other products. Add what you run to find out whether that includes you.

CISA lists it as known exploited since May 31, 2023; federal agencies had to remediate by Jun 21, 2023. Treat that date as your deadline.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Zyxel ZyWALL/USG series firmware

Exploited in the last 30 days

Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, and ATP series firmware versions 4.60 through 5.35, which could allow an unauthenticated attacker to execute some OS commands remotely by sending crafted packets to an affected device.

CVSS: 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-78
Known exploited: Added to CISA KEV May 31, 2023; federal remediation due Jun 21, 2023Apply updates per vendor instructions.
EPSS (exploitation in the next 30 days): 99.28% (percentile 100)
Assigned by: Zyxel
NVD analysis: Analyzed
Record last updated: Oct 21, 2025
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Zyxel ZyWALL/USG series firmware zyxel:zywall_usg_series_firmware (from the name)	4.60 through 4.73	CNA record
Zyxel VPN series firmware zyxel:vpn_series_firmware (from the name)	4.60 through 5.35	CNA record
Zyxel USG FLEX series firmware zyxel:usg_flex_series_firmware (from the name)	4.60 through 5.35	CNA record
Zyxel ATP series firmware zyxel:atp_series_firmware (from the name)	4.60 through 5.35	CNA record
zyxel atp100_firmware zyxel:atp100_firmware	from 4.60 before 5.36	NVD
zyxel atp100w_firmware zyxel:atp100w_firmware	from 4.60 before 5.35	NVD
zyxel atp200_firmware zyxel:atp200_firmware	from 4.60 before 5.36	NVD
zyxel atp500_firmware zyxel:atp500_firmware	from 4.60 before 5.36	NVD
zyxel atp700_firmware zyxel:atp700_firmware	from 4.60 before 5.36	NVD
zyxel atp800_firmware zyxel:atp800_firmware	from 4.60 before 5.36	NVD
1–10 of 23

References

References

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-remote-command-injection-vulnerability-of-firewalls	vendor-advisory
http://packetstormsecurity.com/files/172820/Zyxel-IKE-Packet-Decoder-Unauthenticated-Remote-Code-Execution.html	exploit, third-party-advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-28771	us-government-resource

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.