VulnTideExploited vulnerabilities, by vendor. Data as of .
Not in CISA KEVReported exploited: VulnCheck KEV since Published CVSS 7.5 highEPSS 57.8% probability of exploitation in 30 days
Zyxel

CVE-2023-28770: The sensitive information exposure vulnerability in the CGI “Export_Log” and the binary “zcmd” in Zyxel DX5401-B0 fir…

Is it exploited?

Reported, not confirmed by CISA. VulnCheck KEV lists it as exploited in the wild. CISA has not added it to its Known Exploited Vulnerabilities catalog as of .

VulnCheck KEV lists it since . It cites 282 public reports, the first from .

How likely is exploitation in the next 30 days?
57.8%

EPSS score, percentile 99.1 of all scored records. A probability estimated by FIRST, not a report of exploitation.

CISA's SSVC assessment in the CVE record lists exploitation as poc.

How severe?
7.5 High

CVSS v3.1 base score, given by the CNA

What should I do?

CISA has set no required action, because the vulnerability is not in KEV.

The CVE record links no vendor advisory, patch or mitigation.

Which versions are affected?

Affected

  • < V5.17(ABYO.1)C0

Versions by product

Source: CISA KEV 2026.10.29, as of ; VulnCheck KEV, as of ; FIRST EPSS, as of ; CVE List, as of . About the data.

Description

The sensitive information exposure vulnerability in the CGI “Export_Log” and the binary “zcmd” in Zyxel DX5401-B0 firmware versions prior to V5.17(ABYO.1)C0 could allow a remote unauthenticated attacker to read the system files and to retrieve the password of the supervisor from the encrypted file.

Source: CVE List, as of . About the data.

What to do

Advisories and patches

The CVE record links no vendor advisory, patch or mitigation.

This summary is based on the CVE record as of . Check the vendor's advisory before you act: affected versions and fixes can change.

Affected products and versions

Versions by product, as listed in the CVE record (1 product)
Zyxel DX5401-B0 firmware
StatusVersions
Affected< V5.17(ABYO.1)C0

Source: CVE List, as of . About the data.

Weakness

CWE-200, CWE-203
  • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
  • CWE-203: Observable Discrepancy

CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record.

Timeline

DateEvent
CVE record published
CVE record last updated

References

2

Known exploited Zyxel vulnerabilities

  • CVE-2026-7273: Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability (added )
  • CVE-2024-40890: Zyxel DSL CPE OS Command Injection Vulnerability (added )
  • CVE-2024-40891: Zyxel DSL CPE OS Command Injection Vulnerability (added )
  • CVE-2024-11667: Zyxel Multiple Firewalls Path Traversal Vulnerability (added )
  • CVE-2017-6884: Zyxel EMG2926 Routers Command Injection Vulnerability (added )