Zyxel Firewall and VPN Devices IKE Packet Decoder Remote Command Injection Vulnerability (CVE-2023-28771) Analysis and Mitigation Guide

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2023-28771) is an OS command injection vulnerability (CWE-78) residing in the Internet Key Exchange (IKE) packet decoding engine of Zyxel security appliances. The root cause lies in the improper handling and insufficient sanitization of input values within error messages generated during IKE packet decoding. An unauthenticated attacker can exploit this by sending specially crafted packets, leading to arbitrary command execution on the underlying operating system.

2. Exploitation Mechanics & Attack Scenario

An attacker transmits a crafted IKEv1/IKEv2 proposal packet containing shell metacharacters (such as ';', '&', or '|') within specific fields (e.g., Notification or ID Payloads) to UDP port 500 or 4500 on the target device. When the Zyxel IKE daemon fails to decode the packet, it attempts to log the error or execute a system command using the unsanitized payload. This triggers the execution of the attacker's injected commands with root privileges. This vulnerability is actively exploited in the wild (listed in CISA KEV) for botnet propagation and establishing persistent backdoors.

3. Infrastructure & Business Impact

As firewalls and VPN gateways serve as the primary perimeter defense, compromise of these devices grants attackers an initial foothold inside the corporate network. This can lead to lateral movement, internal network scanning, credential harvesting, and ransomware deployment. Given its CVSS score of 9.8 and an extremely high EPSS score of 0.9928, automated scanning and exploitation pose an immediate threat to business continuity.