CVE-2023-28771 is an OS command injection vulnerability in Zyxel Multiple Firewalls. CISA added it to the Known Exploited Vulnerabilities catalogue on 31 May 2023, which means attackers have used it in real attacks. Organisations running the affected product should apply the vendor fix or mitigation as a priority.
What this vulnerability means for Zyxel firewalls
os command injection means an attacker can pass crafted input that the device's operating system interprets as a shell command. On an internet-facing firewall, that is dangerous because the appliance sits on a trusted boundary and often has reach into internal networks, management planes, and logging paths.
The practical concern is not just code execution on one box, but the privilege that comes with it. If the attacker can run commands on the firewall, they may be able to inspect configuration, alter traffic handling, pivot deeper, or prepare the device for persistence.
How organisations assess exposure
Exposure starts with asset inventory: identify every Zyxel firewall model and management instance in use, then confirm which devices are reachable from the internet or from untrusted networks. For CVE records and product context, the CVE Program and NIST National Vulnerability Database are the standard reference points.
Because the primary definition states that CISA added this issue to KEV, organisations should treat vendor guidance and the KEV catalogue as the authoritative source for patch and prioritisation details rather than relying on secondary summaries. Internet exposure, exposed administration interfaces, and any dependence on remote management should all increase urgency.
Why command injection is especially risky on firewall appliances
A firewall is not a normal application server. It is a control point that can mediate trust, segmentation, and administrative access, so a successful injection often creates a much broader consequence than a single-process compromise. The attacker may inherit the appliance's own privileges and use them to inspect, modify, or disable security-relevant functions.
This class of flaw is also attractive for attackers because it can support both rapid initial compromise and follow-on activity. Once an edge device is owned, it can be used to observe traffic, stage lateral movement, or create a foothold that is harder to notice than a compromise on a workstation or public web app.
Remediation, detection, and post-compromise review
Remediation should follow the vendor's fix or mitigation guidance as the first priority, with compensating controls used only when immediate patching is not possible. If the appliance must remain exposed, reduce who can reach administrative interfaces, constrain management paths, and review whether monitoring is sufficient to detect unexpected command execution or configuration drift.
After remediation, review the device for signs of tampering, altered rules, new accounts, unexpected processes, changed scripts, or unusual outbound connections. If exploitation is suspected, treat the firewall as a potentially compromised trust anchor and examine whether credentials, sessions, API tokens, or other administrative material accessible from the device need to be rotated.
Risk and Threat Considerations
Internet-facing firewall command injection can turn a perimeter control into an attacker-controlled management point. That creates a high-value compromise path because the device may sit close to sensitive routing, authentication, and administrative functions, and attackers often use such footholds to persist or move laterally.
Failure mechanism: Crafted input reaches a command interpreter, and the firewall executes attacker-controlled operating-system commands with the appliance's privileges.
Impact: The attacker may alter security settings, capture data, weaken segmentation, or establish persistence on a trusted edge device.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SI-10 — Information Input Validation | Command injection is prevented by validating and constraining untrusted input before execution. |
| SI-4 — System Monitoring | Exploited firewalls require monitoring for process, configuration, and network anomalies. | |
| CM-6 — Configuration Settings | Firewall exposure depends on hardened configuration and management-plane restrictions. | |
| Recommendation — Apply SI-10 to reject or sanitize inputs that could reach command execution paths. Use SI-4 to detect abnormal appliance processes, rule changes, and outbound connections. Enforce CM-6 to lock down management settings and reduce externally reachable attack surface. | ||
| CIS Controls v8 | CIS-4 — Secure Configuration of Enterprise Assets and Software | Edge appliances need hardened configuration to reduce command injection exposure and management risk. |
| CIS-8 — Audit Log Management | Post-exploitation review depends on logs that show command execution and configuration tampering. | |
| Recommendation — Apply CIS-4 to harden firewall settings and restrict administrative exposure. Use CIS-8 to preserve and review firewall logs for compromise indicators. | ||
Practitioner Guidance
Why practitioners should care: For edge appliances, the response window is usually short because exposure can be externally reachable and exploitation can have outsized network impact. Prioritise affected firewalls alongside other known-exploited edge-device issues, not as routine backlog work.
What to watch for: Pay close attention to administrative log anomalies, unexpected configuration changes, unusual child processes, and any evidence that the appliance contacted unfamiliar external hosts. Those signals can indicate that exploitation occurred before patching.
Practitioner takeaway: On a firewall, command injection is a trust-boundary compromise, so remediation should include both repair of the flaw and a review of whether the device's privileged state was already abused.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org