CVE-2023-28771: Zyxel ATP100 Firmware RCE Vulnerability

CVE-2023-28771 Overview

CVE-2023-28771 is a critical command injection vulnerability affecting multiple Zyxel firewall product lines, including the ZyWALL/USG, VPN, USG FLEX, and ATP series devices. The vulnerability stems from improper error message handling in the IKE (Internet Key Exchange) packet decoder, which allows an unauthenticated attacker to execute arbitrary operating system commands remotely by sending specially crafted packets to an affected device.

This vulnerability is particularly severe because it requires no authentication and can be exploited remotely over the network. Attackers can leverage this flaw to gain complete control over affected firewall appliances, potentially compromising the entire network perimeter security infrastructure.

Critical Impact

This vulnerability is actively exploited in the wild and has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog. Unauthenticated remote attackers can execute arbitrary OS commands, leading to complete device compromise.

Affected Products

• Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73
• Zyxel VPN series firmware versions 4.60 through 5.35
• Zyxel USG FLEX series firmware versions 4.60 through 5.35
• Zyxel ATP series firmware versions 4.60 through 5.35

Discovery Timeline

• April 25, 2023 - CVE-2023-28771 published to NVD
• October 27, 2025 - Last updated in NVD database

Technical Details for CVE-2023-28771

Vulnerability Analysis

CVE-2023-28771 represents a command injection vulnerability (CWE-78) in the IKE packet processing functionality of Zyxel firewall devices. The vulnerability allows remote attackers to inject and execute arbitrary operating system commands without requiring any form of authentication.

The IKE protocol is used for establishing Security Associations (SA) in IPsec VPN connections, and it typically listens on UDP port 500 and 4500. The vulnerable error message handling routine fails to properly sanitize input data received within IKE packets before incorporating it into system commands.

When an affected device receives a maliciously crafted IKE packet, the improper error handling allows attacker-controlled data to be passed directly to a shell command interpreter. This enables full remote code execution with the privileges of the underlying system process, which typically runs as root on these embedded Linux-based appliances.

Root Cause

The root cause of this vulnerability lies in the improper handling of error messages within the IKE packet decoder component. Specifically, the firmware fails to adequately validate and sanitize data extracted from malformed IKE packets before using it in error message generation routines that ultimately execute system commands.

When processing certain malformed IKE packets, the error handling code incorporates user-supplied data into a shell command without proper input sanitization. This classic command injection pattern allows special shell metacharacters and command sequences to be interpreted by the underlying operating system.

Attack Vector

The attack vector for CVE-2023-28771 is network-based and does not require any authentication or user interaction. The vulnerability can be exploited by sending specially crafted UDP packets to the IKE service listening on the affected device.

An attacker can exploit this vulnerability by crafting malicious IKE packets containing shell metacharacters and command sequences within specific packet fields. When the vulnerable device processes these packets and triggers the flawed error handling routine, the injected commands are executed with elevated privileges.

The attack flow typically involves:

1. Identifying an exposed Zyxel firewall device with the IKE service accessible
2. Crafting a malicious IKE packet with command injection payload in specific fields
3. Sending the packet to UDP port 500 or 4500 on the target device
4. The malformed packet triggers the vulnerable error handling code path
5. Injected commands are executed on the underlying operating system

For detailed technical exploitation information, refer to the Packet Storm Exploit Report.

Detection Methods for CVE-2023-28771

Indicators of Compromise

• Unusual outbound connections from Zyxel firewall devices to unknown external IP addresses
• Unexpected processes spawning from IKE-related services on affected devices
• Anomalous UDP traffic patterns on ports 500 and 4500, particularly malformed IKE packets
• Evidence of reverse shell connections or command-and-control beaconing originating from firewall appliances
• Unauthorized configuration changes or new user accounts on Zyxel devices

Detection Strategies

• Deploy network intrusion detection rules to identify malformed IKE packets targeting Zyxel devices
• Monitor firewall device logs for unusual error messages related to IKE packet processing
• Implement behavioral analysis to detect anomalous process execution on firewall appliances
• Use threat intelligence feeds to identify known malicious IP addresses associated with exploitation campaigns

Monitoring Recommendations

• Enable comprehensive logging on all Zyxel firewall devices and forward logs to a SIEM solution
• Monitor network traffic flows for unexpected connections from firewall management interfaces
• Implement file integrity monitoring on critical system files and configurations
• Establish baseline behavior patterns for firewall devices to identify deviations indicative of compromise

How to Mitigate CVE-2023-28771

Immediate Actions Required

• Immediately update all affected Zyxel devices to the latest patched firmware version
• If patching is not immediately possible, restrict network access to IKE services (UDP ports 500 and 4500) from untrusted networks
• Review firewall logs and network traffic for signs of exploitation attempts or successful compromise
• Isolate potentially compromised devices pending forensic investigation and remediation

Patch Information

Zyxel has released firmware updates to address this vulnerability across all affected product lines. Organizations should consult the Zyxel Security Advisory for the specific patched firmware versions for each device model.

Given that this vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, federal agencies and organizations following CISA guidelines should prioritize immediate remediation.

Workarounds

• Implement strict access control lists (ACLs) to limit IKE service access to only trusted IP addresses and networks
• Deploy an external firewall or IPS in front of affected Zyxel devices to filter potentially malicious IKE traffic
• Consider temporarily disabling IPsec VPN functionality if it is not critical to operations until patching can be completed
• Implement network segmentation to limit the blast radius if a firewall device is compromised

# Example: Restrict IKE service access using external firewall rules
# Block UDP 500/4500 from untrusted sources to Zyxel devices

# iptables example (on upstream firewall)
iptables -A FORWARD -p udp --dport 500 -d <ZYXEL_IP> -s <TRUSTED_NETWORK> -j ACCEPT
iptables -A FORWARD -p udp --dport 4500 -d <ZYXEL_IP> -s <TRUSTED_NETWORK> -j ACCEPT
iptables -A FORWARD -p udp --dport 500 -d <ZYXEL_IP> -j DROP
iptables -A FORWARD -p udp --dport 4500 -d <ZYXEL_IP> -j DROP