{"history":[{"alert":0,"cve":"CVE-2023-28771","id":22409,"kind":"epss","observed_at":1794500401,"payload":"{\"date\": \"2026-11-12\", \"epss\": 0.99284, \"percentile\": 0.99938}"},{"alert":0,"cve":"CVE-2023-28771","id":20028,"kind":"epss","observed_at":1794327601,"payload":"{\"date\": \"2026-11-10\", \"epss\": 0.99284, \"percentile\": 0.99937}"},{"alert":0,"cve":"CVE-2023-28771","id":17994,"kind":"epss","observed_at":1794241201,"payload":"{\"date\": \"2026-11-09\", \"epss\": 0.99284, \"percentile\": 0.99937}"},{"alert":0,"cve":"CVE-2023-28771","id":16058,"kind":"epss","observed_at":1794154800,"payload":"{\"date\": \"2026-11-08\", \"epss\": 0.99284, \"percentile\": 0.99937}"},{"alert":0,"cve":"CVE-2023-28771","id":14036,"kind":"epss","observed_at":1794068402,"payload":"{\"date\": \"2026-11-07\", \"epss\": 0.99284, \"percentile\": 0.99937}"},{"alert":0,"cve":"CVE-2023-28771","id":11818,"kind":"epss","observed_at":1793982001,"payload":"{\"date\": \"2026-11-06\", \"epss\": 0.99284, \"percentile\": 0.99937}"},{"alert":0,"cve":"CVE-2023-28771","id":9804,"kind":"epss","observed_at":1793938800,"payload":"{\"date\": \"2026-11-05\", \"epss\": 0.99284, \"percentile\": 0.99937}"},{"alert":0,"cve":"CVE-2023-28771","id":7352,"kind":"epss","observed_at":1793809200,"payload":"{\"date\": \"2026-11-04\", \"epss\": 0.99284, \"percentile\": 0.99937}"},{"alert":1,"cve":"CVE-2023-28771","id":6289,"kind":"cna","observed_at":1793809200,"payload":"{\"containers\": {\"adp\": [{\"providerMetadata\": {\"dateUpdated\": \"2024-08-02T13:51:38.311Z\", \"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\"}, \"references\": [{\"tags\": [\"x_transferred\"], \"url\": \"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-remote-command-injection-vulnerability-of-firewalls\"}, {\"tags\": [\"x_transferred\"], \"url\": \"http://packetstormsecurity.com/files/172820/Zyxel-IKE-Packet-Decoder-Unauthenticated-Remote-Code-Execution.html\"}], \"title\": \"CVE Program Container\"}, {\"metrics\": [{\"other\": {\"content\": {\"id\": \"CVE-2023-28771\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"role\": \"CISA Coordinator\", \"timestamp\": \"2023-11-18T05:00:32.985076Z\", \"version\": \"2.0.3\"}, \"type\": \"ssvc\"}}, {\"other\": {\"content\": {\"dateAdded\": \"2023-05-31\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-28771\"}, \"type\": \"kev\"}}], \"providerMetadata\": {\"dateUpdated\": \"2025-10-21T23:05:48.400Z\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\"}, \"references\": [{\"tags\": [\"government-resource\"], \"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-28771\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2023-05-31T00:00:00.000Z\", \"value\": \"CVE-2023-28771 added to CISA KEV\"}], \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"affected\": [{\"product\": \"ZyWALL/USG series firmware\", \"vendor\": \"Zyxel\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.60 through 4.73\"}]}, {\"product\": \"VPN series firmware\", \"vendor\": \"Zyxel\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.60 through 5.35\"}]}, {\"product\": \"USG FLEX series firmware\", \"vendor\": \"Zyxel\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.60 through 5.35\"}]}, {\"product\": \"ATP series firmware\", \"vendor\": \"Zyxel\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.60 through 5.35\"}]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, and ATP series firmware versions 4.60 through 5.35, which could allow an unauthenticated attacker to execute some OS commands remotely by sending crafted packets to an affected device.\"}], \"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"HIGH\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"scope\": \"UNCHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"version\": \"3.1\"}}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-78\", \"description\": \"CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2023-06-09T00:00:00.000Z\", \"orgId\": \"96e50032-ad0d-4058-a115-4d2c13821f9f\", \"shortName\": \"Zyxel\"}, \"references\": [{\"url\": \"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-remote-command-injection-vulnerability-of-firewalls\"}, {\"url\": \"http://packetstormsecurity.com/files/172820/Zyxel-IKE-Packet-Decoder-Unauthenticated-Remote-Code-Execution.html\"}]}}, \"cveMetadata\": {\"assignerOrgId\": \"96e50032-ad0d-4058-a115-4d2c13821f9f\", \"assignerShortName\": \"Zyxel\", \"cveId\": \"CVE-2023-28771\", \"datePublished\": \"2023-04-25T00:00:00.000Z\", \"dateReserved\": \"2023-03-23T00:00:00.000Z\", \"dateUpdated\": \"2025-10-21T23:05:48.400Z\", \"state\": \"PUBLISHED\"}, \"dataType\": \"CVE_RECORD\", \"dataVersion\": \"5.1\"}"},{"alert":0,"cve":"CVE-2023-28771","id":5129,"kind":"epss","observed_at":1793722800,"payload":"{\"date\": \"2026-11-03\", \"epss\": 0.99284, \"percentile\": 0.99937}"},{"alert":0,"cve":"CVE-2023-28771","id":2911,"kind":"epss","observed_at":1793665375,"payload":"{\"date\": \"2026-11-02\", \"epss\": 0.99284, \"percentile\": 0.99937}"},{"alert":1,"cve":"CVE-2023-28771","id":828,"kind":"kev","observed_at":1793665375,"payload":"{\"cveID\": \"CVE-2023-28771\", \"cwes\": [\"CWE-78\"], \"dateAdded\": \"2023-05-31\", \"dueDate\": \"2023-06-21\", \"forensicTriage\": \"No\", \"knownRansomwareCampaignUse\": \"Unknown\", \"notes\": \"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-remote-command-injection-vulnerability-of-firewalls;   https://nvd.nist.gov/vuln/detail/CVE-2023-28771\", \"product\": \"Multiple Firewalls\", \"requiredAction\": \"Apply updates per vendor instructions.\", \"shortDescription\": \"Zyxel ATP, USG FLEX, VPN, and ZyWALL/USG firewalls allow for improper error message handling which could allow an unauthenticated attacker to execute OS commands remotely by sending crafted packets to an affected device.\", \"vendorProject\": \"Zyxel\", \"vulnerabilityName\": \"Zyxel Multiple Firewalls OS Command Injection Vulnerability\"}"}],"record":{"affected":[{"product":"ZyWALL/USG series firmware","vendor":"Zyxel","versions":[{"status":"affected","version":"4.60 through 4.73"}]},{"product":"VPN series firmware","vendor":"Zyxel","versions":[{"status":"affected","version":"4.60 through 5.35"}]},{"product":"USG FLEX series firmware","vendor":"Zyxel","versions":[{"status":"affected","version":"4.60 through 5.35"}]},{"product":"ATP series firmware","vendor":"Zyxel","versions":[{"status":"affected","version":"4.60 through 5.35"}]}],"cna":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-02T13:51:38.311Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_transferred"],"url":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-remote-command-injection-vulnerability-of-firewalls"},{"tags":["x_transferred"],"url":"http://packetstormsecurity.com/files/172820/Zyxel-IKE-Packet-Decoder-Unauthenticated-Remote-Code-Execution.html"}],"title":"CVE Program Container"},{"metrics":[{"other":{"content":{"id":"CVE-2023-28771","options":[{"Exploitation":"active"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2023-11-18T05:00:32.985076Z","version":"2.0.3"},"type":"ssvc"}},{"other":{"content":{"dateAdded":"2023-05-31","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-28771"},"type":"kev"}}],"providerMetadata":{"dateUpdated":"2025-10-21T23:05:48.400Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"references":[{"tags":["government-resource"],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-28771"}],"timeline":[{"lang":"en","time":"2023-05-31T00:00:00.000Z","value":"CVE-2023-28771 added to CISA KEV"}],"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"product":"ZyWALL/USG series firmware","vendor":"Zyxel","versions":[{"status":"affected","version":"4.60 through 4.73"}]},{"product":"VPN series firmware","vendor":"Zyxel","versions":[{"status":"affected","version":"4.60 through 5.35"}]},{"product":"USG FLEX series firmware","vendor":"Zyxel","versions":[{"status":"affected","version":"4.60 through 5.35"}]},{"product":"ATP series firmware","vendor":"Zyxel","versions":[{"status":"affected","version":"4.60 through 5.35"}]}],"descriptions":[{"lang":"en","value":"Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, and ATP series firmware versions 4.60 through 5.35, which could allow an unauthenticated attacker to execute some OS commands remotely by sending crafted packets to an affected device."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-78","description":"CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2023-06-09T00:00:00.000Z","orgId":"96e50032-ad0d-4058-a115-4d2c13821f9f","shortName":"Zyxel"},"references":[{"url":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-remote-command-injection-vulnerability-of-firewalls"},{"url":"http://packetstormsecurity.com/files/172820/Zyxel-IKE-Packet-Decoder-Unauthenticated-Remote-Code-Execution.html"}]}},"cveMetadata":{"assignerOrgId":"96e50032-ad0d-4058-a115-4d2c13821f9f","assignerShortName":"Zyxel","cveId":"CVE-2023-28771","datePublished":"2023-04-25T00:00:00.000Z","dateReserved":"2023-03-23T00:00:00.000Z","dateUpdated":"2025-10-21T23:05:48.400Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"cna_checked":1794262800,"cve":"CVE-2023-28771","description":"Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, and ATP series firmware versions 4.60 through 5.35, which could allow an unauthenticated attacker to execute some OS commands remotely by sending crafted packets to an affected device.","epss":{"date":"2026-11-12","epss":0.99284,"percentile":0.99938},"epss_checked":1794522003,"first_seen":1793665375,"kev":{"cveID":"CVE-2023-28771","cwes":["CWE-78"],"dateAdded":"2023-05-31","dueDate":"2023-06-21","forensicTriage":"No","knownRansomwareCampaignUse":"Unknown","notes":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-remote-command-injection-vulnerability-of-firewalls;   https://nvd.nist.gov/vuln/detail/CVE-2023-28771","product":"Multiple Firewalls","requiredAction":"Apply updates per vendor instructions.","shortDescription":"Zyxel ATP, USG FLEX, VPN, and ZyWALL/USG firewalls allow for improper error message handling which could allow an unauthenticated attacker to execute OS commands remotely by sending crafted packets to an affected device.","vendorProject":"Zyxel","vulnerabilityName":"Zyxel Multiple Firewalls OS Command Injection Vulnerability"},"kev_checked":1794522003,"products":"Zyxel ZyWALL/USG series firmware, Zyxel VPN series firmware, Zyxel USG FLEX series firmware, Zyxel ATP series firmware","references":["https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-remote-command-injection-vulnerability-of-firewalls","http://packetstormsecurity.com/files/172820/Zyxel-IKE-Packet-Decoder-Unauthenticated-Remote-Code-Execution.html","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-28771"],"score":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","provider":"Zyxel","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"solutions":"","state":"PUBLISHED","title":"Zyxel Multiple Firewalls OS Command Injection Vulnerability","updated_at":1794500401,"workarounds":""},"sources":[]}