Security News > 2023 > May > Hackers exploit critical Zyxel firewall flaw in ongoing attacks

Hackers are performing widespread exploitation of a critical-severity command injection flaw in Zyxel networking devices, tracked as CVE-2023-28771, to install malware.

The flaw, which is present in the default configuration of impacted firewall and VPN devices, can be exploited to perform unauthenticated remote code execution using a specially crafted IKEv2 packet to UDP port 500 on the device.

This alert coincides with additional verification from Rapid7 today that confirms the active exploitation of the flaw.

One of the activity clusters confirmed to exploit CVE-2023-28771 is a Mirai-based botnet malware that, according to Shadowserver, started launching attacks on May 26, 2023.

While the Mirai threat is typically limited to DDoS, other threat groups might engage in lower-scale and less-noticeable exploitation to launch more potent attacks against organizations.

It is also important to note that Zyxel has recently fixed two other critical severity flaws, CVE-2023-33009 and CVE-2023-33010, which impact the same firewall and VPN products.

News URL

https://www.bleepingcomputer.com/news/security/hackers-exploit-critical-zyxel-firewall-flaw-in-ongoing-attacks/