Is CVE-2023-28771 (Zyxel Multiple Firewalls OS Command Injection) being exploited in the wild?

How to Confirm CVE-2023-28771 Is Being Exploited in the Wild

For this CVE, the practical confirmation is the KEV listing itself. CISA added CVE-2023-28771 to the Known Exploited Vulnerabilities catalogue on 31 May 2023, which is CISA’s signal that active exploitation has been observed or reliably evidenced. If the firewall model is in scope, treat it as an exposure requiring immediate verification, not a theoretical weakness.

For edge appliances, the first question is whether the affected device is actually deployed, internet reachable, and still receiving security updates. The Edge Device Security Guide is relevant because internet-facing firewalls often fail in practice through the same combination of exposed management paths, weak logging, and delayed patching.

Use the vendor advisory and the CISA Known Exploited Vulnerabilities Catalog for version-specific remediation details, then verify whether any device has accepted crafted packets from untrusted sources around the time CISA listed the CVE. Where logs are sparse, assume the absence of evidence is not evidence of absence.

What the OS Command Injection Means Operationally

The underlying issue is improper error message handling in Zyxel ATP, USG FLEX, VPN, and ZyWALL/USG firewalls. In practice, that means an unauthenticated attacker may be able to send crafted packets that trigger remote OS command execution on the appliance. This is not just a vulnerability in a management interface, it is a path to appliance-level code execution on a perimeter control plane.

Because the target is a firewall, the blast radius can include traffic interception, policy manipulation, configuration theft, and pivoting into adjacent internal systems. The attack path matters: edge appliances are attractive because they sit in front of high-value networks and often have privileged access to internal routing, VPN, and administrative functions.

The Web Application Attacks Guide is useful here because command injection is a canonical exploitation pattern, even when it is delivered through appliance firmware rather than a traditional web app. The same defensive logic applies: minimize exposed surfaces, assume malformed input may be weaponized, and validate whether the appliance is parsing more than it should.

How to Triage Exposure Without Losing Time

Start with asset inventory, not packet hunting. Confirm every deployed Zyxel firewall model and firmware branch, then determine whether any instance is internet facing or reachable from untrusted networks. If you cannot confidently scope the fleet, treat the issue as a broad exposure problem rather than a single-device patch task.

The Vulnerability Management Guide is the right companion when you need to prioritise by confirmed exploitation, exposure, and remediation status rather than by score alone. For a KEV-listed flaw, the decision point is simple: validate exposure first, then move to containment and patching, and only then spend time on broader optimisation.

If patching must wait, reduce reachability immediately, restrict administrative access paths, and watch for unusual appliance behavior, especially command execution artifacts, new processes, unexpected outbound connections, or configuration changes. Any sign that the firewall itself is behaving like a general-purpose host should be treated as a compromise indicator, not a nuisance alert.

Risk and Threat Considerations

KEV-listed firewall flaws are high risk because the appliance is both internet exposed and operationally trusted. When an attacker can execute OS commands on the edge device, they may gain a foothold that bypasses ordinary endpoint controls and creates direct access to internal traffic and management functions.

Failure mechanism: Crafted packets trigger command execution through improper error handling, allowing an unauthenticated attacker to run commands on the firewall and potentially alter or observe network traffic.

Impact: The appliance can become a staging point for persistence, credential capture, policy tampering, and internal network pivoting, especially if logging and monitoring are weak.

Practitioner Guidance

What to prioritise: Confirm whether any Zyxel firewall in your environment is both affected and exposed, then move the device into emergency remediation status if it is. For edge appliances, confirmed KEV status should outrank routine maintenance queues.

What to verify: Check for signs of earlier compromise before and after remediation, including unexplained config changes, new local accounts, shell access traces, and outbound traffic that does not fit normal firewall behavior. If the appliance logs are incomplete, pair log review with configuration diffing and network telemetry.

Practitioner takeaway: For a KEV-listed edge-device command injection, the key judgement is not whether exploitation is possible, it is whether your exposure window is still open. If the device is internet reachable, assume it is worth an attacker’s time until proven otherwise.

Related resources from NHI Mgmt Group

• CVE-2023-28771 (Zyxel Multiple Firewalls OS Command Injection)
• CVE-2022-30525 (Zyxel Multiple Firewalls OS Command Injection)
• Is CVE-2025-66644 (Array Networks ArrayOS AG OS Command Injection) being exploited in the wild?
• Is CVE-2018-9276 (Paessler PRTG Network Monitor OS Command Injection) being exploited in the wild?