CVE-2023-28807 MEDIUM

CVE-2023-28807: Bypass of ZIA domain fronting detection module through evasion technique

Vendor Zscaler
Product ZIA
Weakness CWE-295
Published January 31, 2024
Last update June 17, 2025

CVSS base score

5.1/10
Attack vector Local
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

In Zscaler Internet Access (ZIA) a mismatch between Connect Host and Client Hello's Server Name Indication (SNI) enables attackers to evade network security controls by hiding their communications within legitimate traffic.

Key dates

02Disclosure timeline

January 31, 2024 CVE published
June 17, 2025 Record updated