What happened
Zyxel has addressed a zero-day vulnerability within its GS1900 series network switches. This flaw was exploited in active attacks, resulting in nearly 1,000 devices worldwide being compromised. Attackers successfully used the vulnerability to steal configuration files and credentials from affected devices. The vulnerability was exploited before the flaw was publicly disclosed, indicating a covert and targeted exploitation effort. The situation has since been rectified with a security update provided by Zyxel.
Who is affected
Organisations running Zyxel GS1900 series network switches are impacted by this vulnerability. The escalating number of compromised devices underscores the widespread nature of the issue across various deployments. It is essential for affected organisations to verify the application of updates to mitigate ongoing threats linked to this flaw.
Recommended actions
- Apply the available security update to affected devices as soon as possible to remediate the vulnerability.
- Verify and review configurations and credentials stored on impacted switches to identify any potential compromise.
- Maintain monitoring of network traffic for unusual activity that may indicate exploitation attempts.
