CVE-2023-28770

🗓️ 27 Apr 2023 00:00:00Reported by ZyxelType

cve🔗 web.nvd.nist.gov👁 345 Views🌐 WEB

The sensitive info exposure vulnerability in Zyxel DX5401-B

Reporter	Title	Published	Views	Family All 18
BDU FSTEC	ZyXEL DX5401-B0 Export_Log Unauthorized Access	29 May 202300:00	–	bdu_fstec
Circl	CVE-2023-28770	27 Apr 202312:39	–	circl
CNNVD	Zyxel DX5401-B0 安全漏洞	27 Apr 202300:00	–	cnnvd
Cvelist	CVE-2023-28770	27 Apr 202300:00	–	cvelist
KittySploit	Zyxel Device - Export_Log File Read (CVE-2023-28770)	10 Aug 202606:19	–	kittysploit
KittySploit	Zyxel Device - Export_Log LFI Detection (CVE-2023-28770)	10 Aug 202606:19	–	kittysploit
Metasploit	Zyxel chained RCE using LFI and weak password derivation algorithm	1 Feb 202200:00	–	metasploit
NVD	CVE-2023-28770	27 Apr 202309:15	–	nvd
OpenVAS	Zyxel Devices Multiple Vulnerabilities (Dec 2022) - Active Check	19 Dec 202200:00	–	openvas
osv_cve	CVE-2023-28770	27 Apr 202309:15	–	osv_cve

NVD

Node

AND

zyxel dx5401-b0_firmwareRange<5.17(abyo.1)c0

zyxel dx5401-b0Match-

[
  {
    "vendor": "Zyxel",
    "product": "DX5401-B0 firmware",
    "versions": [
      {
        "version": "< V5.17(ABYO.1)C0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
packetstormsecurity	www.packetstormsecurity.com/files/172277/Zyxel-Chained-Remote-Code-Execution.html
zyxel	www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities
packetstorm	www.packetstorm.news/files/id/172277

Parameter	Position	Path	Description	CWE
data	path	/Export_Log?/data/zcfg_config.json	LFI vulnerability in Zyxel device exposing device configuration via /Export_Log?/data/zcfg_config.json (sensitive information disclosure) which enables subsequent steps (password derivation leading to RCE).	CWE-200, CWE-203

17 Jun 2026 05:48Current

7.4High risk

Vulners AI Score7.4

CVSS 3.17.5

EPSS0.57778

SSVC

information security vulnerability zyxel dx5401-b0 cve-2023-28770 nvd