Coordinated cyberattacks target two years old Zyxel firewall flaw
Take action: If you still haven't patched your ZyXel firewall, and it's exposed on UDP port 500 to the internet, time to act NOW! Isolate the UDP port 500 from the internet, and start patching your firewalls. And check for any indicators of compromise, if possible even do a factory reset and load a trusted configuration.
Learn More
A coordinated wave of cyberattacks struck Zyxel firewall and VPN devices was detected globally on June 16, 2025.
Hackers are exploiting CVE-2023-28771 (CVSS score 9.8) - a command injection flaw that allows unauthenticated attackers to execute arbitrary system commands remotely.
The vulnerability stems from improper error message handling in Zyxel's Internet Key Exchange (IKE) packet decoder, which processes VPN connection requests over UDP port 500.
Attackers can exploit this vulnerability by sending a single, specially crafted IKE packet to UDP port 500 on vulnerable devices, triggering unauthenticated remote code execution without requiring any authentication or user interaction.
GreyNoise security researchers observed a concentrated burst of exploitation attempts on June 16, 2025, involving 244 unique IP addresses that launched coordinated attacks against vulnerable Zyxel devices globally.
The 244 malicious IP addresses had not engaged in any other scanning or exploit behavior during the two weeks preceding the attack, which means the attackers focus exclusively on exploiting CVE-2023-28771.
The targets are in the United States, United Kingdom, Spain, Germany, and India.
The vulnerable products within their vulnerability support period have been identified and patches released to address the vulnerability:
- ATP series (ZLD V4.60 to V5.35) - Patched in ZLD V5.36
- USG FLEX series (ZLD V4.60 to V5.35) - Patched in ZLD V5.36
- VPN series (ZLD V4.60 to V5.35) - Patched in ZLD V5.36
- ZyWALL/USG series (ZLD V4.60 to V4.73) - Patched in ZLD V4.73 Patch 1
Zyxel urges users to install patches ASAP. The vendor originally disclosed this vulnerability and released security patches on April 25, 2023, providing organizations with over two years to implement protective measures before this recent attack campaign.
For organizations unable to immediately apply patches, network filtering should be implemented to restrict unnecessary exposure of IKE and UDP port 500 services.
