Zyxel fixed multiple vulnerabilities reported by our research team on February 20th, including CVE-2023-6764, a WAN side Pre-Auth RCE in the IPSec VPN service. Update your Zyxel Firewall and AP ASAP. zyxel.com/global/en/support/…

Zyxel fixed two Pre-Auth RCEs (CVE-2023-33009, CVE-2023-33010) reported by our research team. Like CVE-2023-28771, both vulnerabilities are exploitable from the WAN side. Update your Zyxel Firewall ASAP. also kudos to @starlabs_sg zyxel.com/global/en/support/…

Demo video out for Zyxel VPN Pre-Auth RCE (CVE-2023-28771) No extra config or web access needed, exploitable via WAN. More details will be released, patch your device ASAP. youtu.be/R68QJIRSwU0

Yes, we will release more technical details of the vulnerability and exploit.

We have reported a critical Pre-Auth RCE in Zyxel VPN Firewall (CVE-2023-28771) The device can be exploited as soon as it connects to the internet, without any additional configuration. Patch your Zyxel devices as soon as possible. thehackernews.com/2023/04/zy…