What’s Vulnerable › Vulnerabilities

CVE-2023-28770

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 57.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-04-27 · updated 2026-06-17
• Weakness: CWE-200

Description

The sensitive information exposure vulnerability in the CGI “Export_Log” and the binary “zcmd” in Zyxel DX5401-B0 firmware versions prior to V5.17(ABYO.1)C0 could allow a remote unauthenticated attacker to read the system files and to retrieve the password of the supervisor from the encrypted file.

Affected products

• Zyxel DX5401-B0 firmware: before 5.17\(abyo.1\)c0 — fixed in 5.17\(abyo.1\)c0

How to fix

Upgrade to a fixed version: Zyxel DX5401-B0 firmware 5.17\(abyo.1\)c0. Check the vendor advisory for mitigations.

References

• http://packetstormsecurity.com/files/172277/Zyxel-Chained-Remote-Code-Execution.html
• https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities
• http://packetstormsecurity.com/files/172277/Zyxel-Chained-Remote-Code-Execution.html
• https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities
• https://packetstorm.news/files/id/172277

Get alerted when CVE-2023-28770 or the next vulnerability affects your stack