CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2023-04-25
Zyxel Firewall and VPN Devices IKE Packet Decoder Remote Command Injection Vulnerability (CVE-2023-28771) Analysis and Mitigation Guide
[Affected Scope] Zyxel ZyWALL/USG (4.60 to 4.73), VPN (4.60 to 5.35), USG FLEX (4.60 to 5.35), and ATP (4.60 to 5.35) series firmware
[Impact] An unauthenticated remote attacker can execute arbitrary OS commands with root privileges by sending crafted IKE UDP packets to the affected device
[Mitigation] Immediately upgrade to the latest official patched firmware version and restrict access to IKE ports (UDP 500/4500) from untrusted WAN interfaces