Zyxel Firewall Vulnerabilities Reveal the Complexity of the IT Infrastructure Supply Chain

Recently SektorCERT (previously EnergiCERT) published a report on what they state is the largest known cyber attack against Danish critical infrastructure. Digging through the report it appears that an unauthenticated remotely exploitable vulnerability in Zyxel firewalls (CVE-2023-28771) was leveraged to gain the initial foothold. 

This particular vulnerability was externally reported to Zyxel in April 2023 by an independent third party. The vulnerable service was software implementing IPSec and exploited over UDP port 500 using a “specially crafted” IKEv2 packet. Rapid7 …

attack complexity critical critical infrastructure cve cve-2023-28771 cyber firewall firewalls infrastructure it infrastructure report reveal sektorcert state supply supply chain unauthenticated vulnerabilities vulnerability zyxel zyxel firewalls