Zyxel Firewall IKE Unauthenticated Command Injection
- Product
- Zyxel ATP / USG FLEX / VPN / ZyWALL firewalls
- CVE
- CVE-2023-28771
- Disclosed
- 2023-04-25
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- ATP, USG FLEX and VPN series ZLD V4.60-V5.35; ZyWALL/USG ZLD V4.60-V4.73.
- Fixed
- ATP/USG FLEX/VPN ZLD V5.36; ZyWALL/USG V4.73 Patch 1.
Summary
An unauthenticated command injection in how Zyxel firewalls handled IKE packets on UDP 500 allowed remote command execution. It was mass-exploited by Mirai-based botnets and contributed to a wave of attacks on Danish critical infrastructure.
Root cause
When the IKE daemon failed to decode certain packets, it logged an error through a code path that built a shell command containing attacker-controlled data. Malformed IKEv2 packets therefore lead to command injection as root, with no VPN configuration required beyond the WAN-exposed IKE service.
Impact
Unauthenticated root code execution on the firewall.
Detection
Monitor for malformed IKE traffic on UDP 500 and version-check ZLD firmware.
Mitigation
Upgrade firmware; restrict IKE exposure where VPN is unused.