VulnSocial

CVE-2023-28771Active Exploitation(zyxel / atp100)

MEDIUMCVSS 9.8 · CRITICALCISA KEV

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

  • Prioritize remediation for zyxel atp100 systems immediately
  • Assume compromise if assets are exposed
  • Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, and ATP series firmware versions 4.60 through 5.35, which could allow an unauthenticated attacker to execute some OS commands remotely by sending crafted packets to an affected device.

zyxel CVEsBack to dashboard
4.0/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2023-06-21. Apply updates per vendor instructions.

Exploit / PoC references
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-78

Priority

MEDIUM

Exploitation

ACTIVE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • atp100
  • atp100_firmware
  • atp100w
  • atp100w_firmware

Threat summary

  • Active exploitation appears in 2 classified signals
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Active exploitation reported across 2 signals
  • Technical details provided in 2 signals
  • Peaked 1d ago at 1 mentions (2026-03-27); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
zyxel
Products
atp100atp100_firmwareatp100watp100w_firmwareatp200atp200_firmwareatp500atp500_firmwareatp700atp700_firmware

2 versions affected across 38 products

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-03-27: 1Mentions · 2026-06-15: 1Active Exploitation · 2026-03-27: 1Active Exploitation · 2026-06-15: 1Technical Details · 2026-03-27: 1Technical Details · 2026-06-15: 103-2706-15
Signal classification1 categories
Active Exploitation
2100.0%
Referenced assets2 URLs
By indicator
Full discourse2 posts
  • @pedri77@pedri77
    Active Exploitation

    Zyxel users beware: A critical remote code execution flaw (CVE-2023-28771) in Zyxel devices is under active exploitation by a Mirai-like botnet. GreyNoise observed a surge on June 16, targeting devices globally. https://f.mtr.cool/abqbcqnway

    Post summary

    The post warns that the CVE-2023-28771 remote code execution flaw is actively exploited by a Mirai-like botnet, with GreyNoise reporting increased activity on June 16.

    0000047
    2.1K followersView on X
  • @pedri77@pedri77
    Active Exploitation

    GreyNoise researchers have observed exploit attempts targeting the remote code execution vulnerability CVE-2023-28771 in Zyxel devices. On June 16, GreyNoise researchers detected exploit attempts targeting CVE-2023-2877... https://f.mtr.cool/seikawkhxh

    Post summary

    GreyNoise researchers reported active exploitation attempts targeting the remote code execution vulnerability CVE-2023-28771 in Zyxel devices.

    0000064
    2.1K followersView on X
CPE platform detail40 entries

40 of 40 entries

PartVendorProductVersionTarget SWTarget HW
HWzyxelatp100---
OSzyxelatp100_firmware---
HWzyxelatp100w---
OSzyxelatp100w_firmware---
HWzyxelatp200---
OSzyxelatp200_firmware---
HWzyxelatp500---
OSzyxelatp500_firmware---
HWzyxelatp700---
OSzyxelatp700_firmware---
HWzyxelatp800---
OSzyxelatp800_firmware---
HWzyxelusg_flex_100---
OSzyxelusg_flex_100_firmware---
HWzyxelusg_flex_100w---
OSzyxelusg_flex_100w_firmware---
HWzyxelusg_flex_200---
OSzyxelusg_flex_200_firmware---
HWzyxelusg_flex_50---
HWzyxelusg_flex_500---
OSzyxelusg_flex_500_firmware---
OSzyxelusg_flex_50_firmware---
HWzyxelusg_flex_50w---
OSzyxelusg_flex_50w_firmware---
HWzyxelusg_flex_700---
OSzyxelusg_flex_700_firmware---
HWzyxelvpn100---
HWzyxelvpn1000---
OSzyxelvpn1000_firmware---
OSzyxelvpn100_firmware---
HWzyxelvpn300---
OSzyxelvpn300_firmware---
HWzyxelvpn50---
OSzyxelvpn50_firmware---
HWzyxelzywall_usg_100---
OSzyxelzywall_usg_100_firmware---
OSzyxelzywall_usg_100_firmware4.73--
HWzyxelzywall_usg_310---
OSzyxelzywall_usg_310_firmware---
OSzyxelzywall_usg_310_firmware4.73--

Explore more

Back to dashboardzyxel CVEsatp100 vulnerabilities