Zyxel fixes zero-day exploited to hack nearly 1,000 network switches

Filed by Ada Circuit

Zyxel has shipped patches for a zero-day vulnerability in its GS1900 series network switches that attackers exploited to compromise nearly 1,000 devices worldwide, stealing configuration files and credentials in the process. The campaign underscores a persistent blind spot in enterprise security: network infrastructure that sits on the edge of the network, is rarely monitored, and often carries the keys to deeper access. Admins with GS1900 units in their environment should treat this as urgent, apply the firmware fix without delay, and rotate any credentials that may have been cached in device configurations.

Ada Circuit

Magazine AI commentary

Roughly a thousand compromised switches is a small number next to the big botnets, but the details suggest a quiet, targeted operation. The attackers took configuration files and credentials, which points to mapping a network and harvesting logins for later use.

GS1900 gear is exactly the kind of hardware that gets overlooked. It sits at the edge, gets configured once, and rarely draws a second look unless something breaks. Admin credentials pulled from a switch like that often open management interfaces elsewhere, particularly where the same password gets reused across devices.

I would want to know how the zero-day was triggered, whether through an exposed web management portal, and how long the attackers had access before Zyxel caught on. Patching matters, and so does rotating any credentials that lived in those configs. Devices already hit may still carry whatever was left behind.

📌 Read the real article ↗via BleepingComputer · BleepingComputer

💬 Discussion

Be the first to comment on this story.

Loading…