Unauthenticated OS command injection in Zyxel firewall firmware

This repository contains a single Metasploit module (zyxel_ike_decoder_rce_cve_2023_28771.rb) that exploits CVE-2023-28771, a critical unauthenticated remote code execution vulnerability in the IKE packet decoder of several Zyxel firewall and VPN devices. The exploit targets the IKE service exposed on UDP port 500 of the WAN interface, which is enabled by default on affected devices. By sending a specially crafted IKE packet containing a command injection payload, the module achieves code execution as root. The module supports delivering various command payloads, with a default Meterpreter reverse shell via HTTP fetch. The exploit is operational and can be used to gain full control of vulnerable Zyxel devices. The code is written in Ruby and is structured as a standard Metasploit exploit module, with clear separation of check, exploit, and payload delivery logic. No hardcoded IPs or domains are present, but the attack is fingerprintable by its use of UDP/500 and the IKE protocol.

This repository provides a proof-of-concept exploit for CVE-2023-28771, a command injection vulnerability affecting Zyxel firewall and VPN devices. The main file, 'CVE-2023-28771-poc.py', is a Python script that uses the Scapy library to craft and send a malicious IKEv2 packet to a specified target (rhost) on UDP port 500. The script allows the user to either execute an arbitrary shell command on the target device (using the --cmd argument) or spawn a reverse shell back to the attacker's machine (using --lhost and --lport arguments). The payload is embedded in the Notify payload of the IKEv2 packet. The repository also includes a README.md with usage instructions and a requirements.txt specifying the Scapy dependency. The exploit is operational and can be used to gain remote code execution on vulnerable Zyxel devices exposed to the internet.