Fortinet FortiGuard Labs researchers are tracking multiple DDoS botnets actively exploiting CVE-2023-28771, a command injection flaw in Zyxel firewalls scoring 9.8 on the CVSS scale. The vulnerability has been under active exploitation since at least late May, and the number of exposed devices appears substantially larger than early counts suggested.
At a glance
- CVE-2023-28771: CVSS 9.8 command injection in Zyxel ZyWALL/USG, VPN, USG FLEX, and ATP series
- Affected firmware: ZyWALL/USG 4.60–4.73, VPN 4.60–5.35, USG FLEX 4.60–5.35, ATP 4.60–5.35
- Flaw resides in the VPN service, which ships enabled on the WAN interface by default
- At least 42,000 Zyxel devices had their web interface exposed on non-preferred WAN as of mid-May
- Real count is likely much higher since the vulnerable VPN service runs regardless of web interface exposure
- Confirmed in active exploitation since May 26; compromised devices enrolled in Mirai-style botnets
- Public PoC exists; attack volume climbing
- Identified botnets: Dark.IoT (Mirai variant), SHINJI.APP | Katana botnet
- Zyxel released a patch in late April
How exploitation unfolds
The vulnerability stems from improper error message handling in affected firmware. An unauthenticated attacker sends crafted IKE packets over UDP to a device, and the device runs whatever commands the attacker embedded. Because the vulnerable service starts automatically on the WAN interface, no user action or credentials are needed for the attack to succeed.
After initial compromise, attackers drop scripts using common utilities like curl or wget. Those scripts exclusively fetch payloads compiled for the MIPS architecture, the processor type common in older routers and embedded hardware. Fortinet saw attack traffic spike sharply after the exploit module went public, with botnets pushing updated malware within days to keep devices under control.
Rapid7's scan identified over 42,000 Zyxel systems with web interfaces visible on non-preferred WAN as of May 19. However, the vulnerable VPN component listens on the WAN regardless of whether the admin panel is exposed, meaning that figure only captures a subset. Shadowserver, meanwhile, logged hits across more than 700 IKEv2-aware honeypots worldwide starting May 26.
Botnets built from this flaw
Multiple groups are using the same entry point to grow Mirai-style botnets. Dark.IoT has been identified as one Mirai variant using CVE-2023-28771. The SHINJI.APP | Katana botnet also relies on this vulnerability, with its operators publicly advertising updates and maintenance. Both campaigns use multiple command infrastructure servers to coordinate attacks and push refreshed payloads.
Why this matters
Threat groups have always prioritized recruiting vulnerable internet-facing devices, and the availability of pre-built exploit code for a 9.8-severity flaw makes this a particularly efficient recruitment opportunity. Compromised firewalls can be weaponized for DDoS, resold on access markets, or used as stepping stones into connected networks. The default-enabled nature of the vulnerable service means many devices were exposed before any patch existed.
Practical example
Imagine you manage 200 customer firewalls as an MSP, with roughly half running unpatched Zyxel firmware. An automated scan of your IP space identifies the VPN service on each WAN-facing device. Within a single night, an attacker chains the public exploit across your entire unpatched base. By morning, you have 100 devices enrolled in a Mirai variant, launching DDoS traffic against a third party. Your customers experience service disruption, you face incident response bills, and regulatory questions follow. A patch released months earlier would have prevented the entire scenario.
Key takeaways
- Patch all affected Zyxel devices immediately; the fix has been available since late April
- If immediate patching isn't possible, restrict VPN and management interface access to known IP ranges
- Scan for devices exposing VPN services on WAN; assume unpatched units are already compromised
- Monitor for unusual outbound connections, especially to known botnet command infrastructure
Frequently asked questions
Which Zyxel product lines are affected?
The flaw impacts ZyWALL/USG (firmware 4.60–4.73), VPN (4.60–5.35), USG FLEX (4.60–5.35), and ATP (4.60–5.35) series devices.
Why is the true count of vulnerable devices higher than the 42,000 figure?
Rapid7's 42,000 tally only counts units with the web interface exposed on non-preferred WAN. The vulnerable VPN service listens on the WAN by default regardless of web interface settings, so many more devices are likely exposed.
How can I verify whether my devices are patched?
Compare your current firmware version against the affected range and confirm that Zyxel's April patch has been applied. Zyxel publishes version-specific remediation guidance.
Can I mitigate the risk without patching?
Limiting inbound access to VPN and management interfaces to a whitelist of trusted IPs cuts exposure substantially. Intrusion prevention signatures can block known attack patterns, but neither workaround replaces a full patch.
What happens if a device is compromised?
Compromised units get enrolled in botnets for DDoS, repurposed for further network intrusion, or sold to other threat actors. They also serve as potential pivot points into attached internal networks.