Vendor

Zyxel

Vulnerabilities in Zyxel ZyWALL/USG, USG FLEX, ATP, and VPN-series firewalls and other SMB/branch-office edge networking gear — perimeter appliances that recur on the CISA KEV catalog and remain a durable target for botnet operators years after patch availability.

CVEs

CVE-2023-28771

[ CRITICAL ] CVSS 9.8 EPSS 99.3% kev

Zyxel Firewall OS Command Injection

An OS command-injection vulnerability in multiple Zyxel firewall product lines allows an unauthenticated attacker to execute arbitrary commands by sending a crafted packet to the device. Exploited by Mirai-variant botnets shortly after disclosure.

Zyxel / ZyWALL/USG, USG FLEX, ATP, and VPN series firewalls Apr 25, 2023

Articles

~/articles/2026-07-15-zyxel-cve-2023-28771-epss-099-three-years-post-patch

Analysis

zyxel

Zyxel CVE-2023-28771: EPSS 0.99 three years after the patch

Zyxel's 2023 firewall command-injection bug still ranks EPSS 0.99 three years post-patch. Scans stay constant; unpatched SMB perimeter boxes remain plentiful.

Jul 15 read →