CVE-2023-28770: Zyxel DX5401-B0 firmware information exposure via Export_Log and zcmd

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityCVSS 7.5 with network reachability and no authentication, plus very high EPSS percentile, makes this a high-priority exposure despite no KEV listing.

What it is

The CGI "Export_Log" and binary "zcmd" in Zyxel DX5401-B0 firmware before V5.17(ABYO.1)C0 expose sensitive system files and allow retrieval of the supervisor password from an encrypted file. A remote unauthenticated attacker can read these files, leaking credentials and system data.

Impact

An attacker gains read access to system files and the supervisor password, enabling further compromise of the device and potentially the network it serves.

Attack surface

Reachable over the network via the affected CGI and binary; no authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

Not listed in CISA KEV; EPSS probability is 0.57778 (99.041 percentile), indicating high predicted exploitation activity, and a Packet Storm reference describes chained remote code execution.

What to do

• Upgrade Zyxel DX5401-B0 firmware to V5.17(ABYO.1)C0 or later.
• Restrict network access to the device management interface and CGI endpoints to trusted networks.
• Change the supervisor password after patching in case it was exposed.
• Monitor vendor advisory for additional mitigations or updates.

Detection

• Monitor HTTP requests to the Export_Log CGI endpoint for unusual or unauthorized access.
• Detect execution or invocation of the zcmd binary outside expected administrative workflows.
• Alert on anomalous reads of system files or encrypted credential files on the device.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.