CISA's required action for CVE-2023-28771 is to apply updates per vendor instructions. In practice, find every instance of Zyxel Multiple Firewalls in your estate, apply the vendor security update or documented mitigation, and if no fix can be applied, remove internet exposure or take the product out of service. After patching, review logs for signs of earlier exploitation, because attackers used this flaw in the wild.
What patching CVE-2023-28771 has to cover in a real firewall estate
For this CVE, the practical problem is not just a single vulnerable box. It is the combination of exposed edge devices, management-plane reachability, and the possibility that an exploited firewall was already used as a foothold. Start by building a complete inventory of Zyxel Multiple Firewalls, then confirm which units are internet-facing, which are remotely managed, and which still sit in service without a clear owner.
The fix path should follow the vendor’s update instructions, but mitigation quality depends on how tightly you reduce exposure around the appliance. If a unit cannot be patched promptly, remove public reachability to the management interface, segment it from untrusted networks, and treat continued exposure as an exception that needs explicit approval and a short expiry.
Because command injection can convert a firewall into an execution point, the immediate post-change question is whether the device was already abused. Review authentication, configuration, and system logs for unfamiliar admin activity, new accounts, unexpected commands, and changes to forwarding or remote access settings. If the logs are sparse, assume visibility is limited and widen the review to adjacent control points such as VPN, SIEM, and network telemetry.
Why this vulnerability is dangerous on perimeter appliances
Perimeter firewalls are high-value targets because they often combine internet exposure, privileged management access, and trust from internal networks. A command injection flaw on that kind of device can be used to run attacker-controlled commands, alter configuration, or prepare the box for persistence and lateral movement. That is why “patch later” is a poor plan when the appliance is still exposed to the internet.
Edge Device Security Guide is a useful companion here because it focuses on the operational realities that matter most for internet-facing appliances: management exposure, device hardening, logging, and end-of-life planning.
Web Application Attacks Guide also maps well to this CVE because OS command injection is a classic injection outcome, and the defensive lesson is the same: reduce input-driven execution paths and remove unnecessary attack surface.
If the firewall is also functioning as a remote-access gateway, compromise can have a much wider blast radius than the product name suggests. The attacker is not only targeting the device itself, but the trust boundary it represents for everything behind it.
How to confirm exposure and decide whether patching is enough
The first decision is whether the affected firewall is actually reachable in a way that makes exploitation plausible. Validate product identification, firmware lineage, and management exposure before you assume the update plan is complete. If you cannot confirm the exact deployment state, you do not yet know whether the device is safe.
Vulnerability Management Guide is relevant because this is a prioritisation problem as much as a patching problem: scope the asset, confirm exploitability, apply the fix, and verify closure instead of relying on a ticket being marked done.
CISA Known Exploited Vulnerabilities Catalog matters here because exploitation in the wild changes the response threshold. Once a flaw is in KEV, internet-facing exposure and delayed remediation become materially harder to justify.
The best operational split is simple: patch when you can, mitigate when you must, and retire the product if neither path gives you acceptable risk. For edge security devices, “temporary” exposure has a habit of becoming permanent unless someone owns the closure date.
Risk and Threat Considerations
Perimeter firewalls are attractive because they sit at the intersection of trust, access, and visibility. If an attacker gets command execution on the appliance, they may be able to change rules, create persistence, weaken inspection, or use the device as a pivot point into internal systems.
Failure mechanism: The flaw allows crafted input to reach an operating-system command context on a trusted edge device, so a remote attacker can turn a management or service interface into code execution and post-exploitation control.
Impact: The likely consequences are unauthorized configuration changes, hidden access paths, loss of perimeter integrity, and increased probability of internal compromise if the device was already exposed or abused before patching.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | This is a KEV-listed appliance flaw that requires rapid identification and remediation. |
| Recommendation — Prioritise, patch, and verify the exposed Zyxel devices through continuous vulnerability management. | ||
| NIST SP 800-53 Rev 5 | RA-5 — Vulnerability Monitoring and Scanning | Exposure confirmation and remediation verification are central to handling this exploited CVE. |
| SI-2 — Flaw Remediation | The issue is resolved through vendor-directed update or mitigation on vulnerable firewalls. | |
| AU-6 — Audit Review, Analysis, and Reporting | Post-patch log review is needed to detect signs of earlier exploitation on the firewall. | |
| Recommendation — Scan for affected appliances, confirm exposure, and track remediation to closure. Apply the vendor update or documented mitigation and document exception handling if patching must wait. Review firewall and adjacent telemetry for indications of prior exploitation or tampering. | ||
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | If the appliance cannot be safely fixed, removing it from service is the correct lifecycle response. |
| Recommendation — Retire or isolate the vulnerable firewall when remediation cannot be completed safely. | ||
| MITRE ATT&CK | T1068 — Exploitation for Privilege Escalation | OS command injection on a trusted appliance can provide elevated execution on the device. |
| Recommendation — Hunt for privilege-escalation and post-exploitation activity on the compromised appliance. | ||
Practitioner Guidance
What to prioritise: Patch every internet-facing Zyxel firewall first, then move inward to devices with remote management enabled or unclear ownership. If patch windows are constrained, prioritise the appliances that can be reached from untrusted networks or that protect sensitive zones.
What to verify: After remediation, verify not only that the update was applied, but that no suspicious admin actions, rule changes, VPN configuration changes, or unexpected outbound connections appeared before the fix. A clean version number alone is not proof of a clean device.
Practitioner takeaway: Treat this as an edge-device compromise problem, not only a patching task. The real control objective is to remove exploitable exposure fast, then prove the firewall was not already used as an attacker foothold.
Related resources from NHI Mgmt Group
- How do you patch or mitigate CVE-2022-30525 (Zyxel Multiple Firewalls OS Command Injection)?
- Is CVE-2023-28771 (Zyxel Multiple Firewalls OS Command Injection) being exploited in the wild?
- CVE-2023-28771 (Zyxel Multiple Firewalls OS Command Injection)
- How do you patch or mitigate CVE-2023-33010 (Zyxel Multiple Firewalls Buffer Overflow)?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 18, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org