cbcvebase.
CVE-2023-28770
published 2023-04-27

CVE-2023-28770: The sensitive information exposure vulnerability in the CGI “Export_Log” and the binary “zcmd” in Zyxel DX5401-B0 firmware versions prior to V5.17(ABYO.1)C0…

PriorityP181high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
57.78%
99.0th percentile
The sensitive information exposure vulnerability in the CGI “Export_Log” and the binary “zcmd” in Zyxel DX5401-B0 firmware versions prior to V5.17(ABYO.1)C0 could allow a remote unauthenticated attacker to read the system files and to retrieve the password of the supervisor from the encrypted file.

Affected

2 ranges
VendorProductVersion rangeFixed in
zyxeldx5401-b0_firmware< V5.17(ABYO.1)C0V5.17(ABYO.1)C0
zyxeldx5401-b0_firmware< 5.17\(abyo.1\)c05.17\(abyo.1\)c0

Detection & IOCsextracted from sources · hover to see the quote

path/bin/zhttpd↗
path/bin/zcmd↗
url/Export_Log?/data/zcfg_config.json↗
path/data/zcfg_config.json↗
  • →Monitor for unauthenticated HTTP GET requests to the /Export_Log CGI endpoint, especially those with path traversal patterns referencing internal config files such as /data/zcfg_config.json. ↗
  • →Alert on successful SSH logins using the 'supervisor' account on affected Zyxel devices, particularly following HTTP requests to /Export_Log, as the exploit chain uses LFI to derive the supervisor password from the device serial number. ↗
  • →Flag retrieval of zcfg_config.json via the Export_Log LFI vector, as this file contains the full router configuration including credentials needed for the second stage of the attack chain. ↗
  • ·The exploit targets more than 40 Zyxel routers and CPE devices beyond just the DX5401-B0; scope of affected devices is broader than the NVD entry implies. ↗
  • ·The supervisor password is derived algorithmically from the device serial number (weak derivation), meaning an attacker only needs the serial number (obtainable via LFI) to compute valid credentials — no brute force required. ↗
  • ·The attack is fully unauthenticated and chained: LFI via zhttpd/Export_Log discloses config (stage 1), then zcmd password derivation enables SSH RCE as supervisor (stage 2). Both stages must be considered in detection coverage. ↗

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
vulncheck7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.