Grey Noise Observes Exploit Attempts Targeting Zyxel CVE-2023-28771

Summary: On June 16, GreyNoise observed a concentrated burst of exploit attempts against CVE-2023-28771, a remote code execution vulnerability in Zyxel IKE packet decoders over UDP port 500, with 244 unique IPs attempting exploitation. All 244 IPs are registered to Verizon Business infrastructure and geolocated to the United States, though GreyNoise notes spoofing is possible over UDP, and analysis found indicators consistent with Mirai botnet variants as confirmed by VirusTotal.
Key Takeaway: GreyNoise reports that in the two weeks before June 16 these 244 IPs showed no other scanning or exploit behavior, meaning a single-purpose burst can appear with little prior warning, and because the traffic rides UDP port 500 the listed U.S. Verizon addresses may not be the true source.

Read the original at GreyNoise Blog ↗

Topics: Detection & Response
Mentions: CVE-2023-28771
Related: CVE-2023-28771: Zyxel Multiple Firewalls OS Command Injection Vulnerability Known Exploited Vulnerabilities · May 31, 2023
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026
Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026