Loading vulnerability…
CVE-2023-28770 is a sensitive information exposure vulnerability affecting Zyxel DX5401-B0 firmware versions prior to V5.17(ABYO.1)C0. The flaw is present in the CGI component Export_Log and the zcmd binary. A remote unauthenticated attacker can exploit the issue to read system files and recover the supervisor password from an encrypted file, resulting in disclosure of sensitive device information and administrative credentials.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a single Metasploit module (zyxel_lfi_unauth_ssh_rce.rb) that exploits a chain of vulnerabilities (CVE-2023-28770) in multiple Zyxel routers and CPE devices. The exploit leverages an unauthenticated local file inclusion (LFI) vulnerability in the /bin/zhttpd binary, allowing attackers to read sensitive configuration data (including the device serial number) via the /Export_Log?/data/zcfg_config.json HTTP endpoint. Using this information, the module derives the 'supervisor' SSH password by exploiting a weak password derivation algorithm in the /bin/zcmd binary. The module then authenticates to the device via SSH as 'supervisor' and executes a payload, which can be a reverse shell, Meterpreter session, or an interactive SSH session. The exploit is weaponized, supports multiple payloads and architectures, and is highly automated. The repository is structured as a single Ruby file compatible with the Metasploit framework, and is intended for use by penetration testers and security researchers targeting vulnerable Zyxel devices.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A command injection vulnerability affecting Zyxel routers, cited as part of the known exploit set relevant to Zyxel devices targeted in the broader Ngioweb ecosystem.
A configuration disclosure vulnerability in Zyxel customer-provided equipment that could expose sensitive configuration information.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.