Act today High Patch available
Zyxel patches switch zero-day used to hack nearly 1,000 devices
BleepingComputerZyxel
What happened. Zyxel patched a zero-day flaw in its GS1900 series network switches. Hackers exploited it to compromise nearly 1,000 devices worldwide and steal configuration files and credentials.
Who is affected. Users of Zyxel GS1900 series switches. The report does not give affected versions. Sites using them in plant networks may have exposed credentials.
What to do. Check whether you run Zyxel GS1900 switches, apply the vendor patch, and change credentials stored on or used by affected devices.
When to act. Act today: the source reports it has been used in attacks
Editor's reading
Forasset ownerOT security leadIT security
- Purdue level
- L3
- L2
Why: Network switches carry traffic within plant networks, so they sit mainly at the site operations and control network levels (L3 and L2).
- Are you exposed?
Search the asset inventory for Zyxel GS1900 series switches and check whether their management interfaces are reachable from untrusted networks.
- If you cannot fix it yet
- Restrict switch management interfaces to a dedicated management network and known administrator hosts.
- Block internet access to switch management services.
- Change switch and related credentials after patching.
- Watch for
- Management logons to GS1900 switches from unexpected hosts.
- Configuration file downloads or exports from switches outside change windows.
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: BleepingComputer (opens bleepingcomputer.com)
More on Zyxel