{"id":"CVE-2023-28770","published":"2023-04-27T00:00:00Z","modified":"2025-01-31T18:42:32Z","title":"The sensitive information exposure vulnerability in the CGI “Export_Log” and the binary “zcmd” in Zyxel DX5401-B0…","vendor":"Zyxel","product":"DX5401-B0 firmware","tier":"core","eol":null,"affectedVersions":[{"vendor":"Zyxel","product":"DX5401-B0 firmware","versions":["< V5.17(ABYO.1)C0"]}],"description":{"text":"The sensitive information exposure vulnerability in the CGI “Export_Log” and the binary “zcmd” in Zyxel DX5401-B0 firmware versions prior to V5.17(ABYO.1)C0 could allow a remote unauthenticated attacker to read the system files and to retrieve the password of the supervisor from the encrypted file.","provenance":"source","from":"CVE.org"},"summary":{"text":"A sensitive information exposure flaw in the \"Export_Log\" CGI and the \"zcmd\" binary of the Zyxel DX5401-B0 firmware allows a remote, unauthenticated attacker to read system files and recover the supervisor password from an encrypted file. The attack requires only network access to the device, with no authentication, no user interaction, and no special configuration.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:13:16Z"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.57778,"percentile":0.99084,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2023-11-28","exploitedFirstSeen":"2023-11-28","ransomware":false,"evidence":[{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-28&host_type=src&vulnerability=cve-2023-28770","date":"2023-11-28"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-22&host_type=src&vulnerability=cve-2023-28770","date":"2024-01-22"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-24&host_type=src&vulnerability=cve-2023-28770","date":"2024-01-24"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-28&host_type=src&vulnerability=cve-2023-28770","date":"2024-01-28"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-30&host_type=src&vulnerability=cve-2023-28770","date":"2024-01-30"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-02-01&host_type=src&vulnerability=cve-2023-28770","date":"2024-02-01"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-02-08&host_type=src&vulnerability=cve-2023-28770","date":"2024-02-08"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-02-16&host_type=src&vulnerability=cve-2023-28770","date":"2024-02-16"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-02-27&host_type=src&vulnerability=cve-2023-28770","date":"2024-02-27"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-03-01&host_type=src&vulnerability=cve-2023-28770","date":"2024-03-01"}],"evidenceTotal":283,"provenance":"source"},"exploited":true,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor"},{"id":"CWE-203","name":"Observable Discrepancy"}],"references":[{"url":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities","tags":[]},{"url":"http://packetstormsecurity.com/files/172277/Zyxel-Chained-Remote-Code-Execution.html","tags":[]},{"url":"https://packetstorm.news/files/id/172277","tags":["exploit"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-32405","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-32405","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"metasploit":[{"name":"Zyxel chained RCE using LFI and weak password derivation algorithm","module":"exploit/linux/http/zyxel_lfi_unauth_ssh_rce","type":"exploit","disclosureDate":"2022-02-01","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/zyxel_lfi_unauth_ssh_rce.rb"}],"first":{"date":"2022-02-01","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/zyxel_lfi_unauth_ssh_rce.rb"},"provenance":"source"},"exploitRefs":["https://packetstorm.news/files/id/172277","http://packetstormsecurity.com/files/172277/Zyxel-Chained-Remote-Code-Execution.html"],"flow":[],"timeline":[{"date":"2022-02-01","kind":"exploit-public","label":"First public exploit: Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/zyxel_lfi_unauth_ssh_rce.rb","provenance":"source"},{"date":"2023-04-27","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2023-28770","provenance":"source"},{"date":"2023-11-28","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-28&host_type=src&vulnerability=cve-2023-28770","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":65.1,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1068 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.82,"detail":"percentile 0.9908"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 NVD exploit link; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":5.25,"detail":"base score 7.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}