CVE-2023-28771

CVE-2023-28771 is a software vulnerability, specifically a command injection flaw, in Zyxel ZyWALL firewalls. The vulnerability was detected by FortiGuard Labs in June 2023 when it was being exploited by several Distributed Denial of Service (DDoS) botnets. It's worth noting that this vulnerability had a significant global impact, affecting 43% of organizations worldwide. Check Point IPS, Harmony Endpoint, and Threat Emulation provide protection against threats exploiting this vulnerability. In May 2023, around 22 Danish energy organizations were targeted in two distinct waves of cyberattacks, one of which exploited CVE-2023-28771. The initial breach and reconnaissance started on May 11, with the attackers exploiting the vulnerability at 16 companies. Research from cybersecurity firm ForeScout challenged the attribution of these attacks to Sandworm, suggesting instead two separate waves of attacks - one exploiting CVE-2023-28771 and another using Mirai botnet variants on infected hosts as an access point. To gain access to victims' networks, threat actors exploited several Remote Command Execution (RCE) vulnerabilities in Zyxel firewalls, including CVE-2023-28771, which was patched by the vendor in April 2023. These intrusions underline the importance of timely patching and maintaining up-to-date security systems. Despite the patch being available, the continued exploitation of this vulnerability indicates a lag in its application across many organizations, leading to substantial security risks.