For awareness Low Check exposure in your normal cycle
Article compares Zyxel's statement with researchers' reports
shattered.io (via Google News)Zyxel
What happened. A shattered.io piece sets out what Zyxel confirmed and what researchers reported. The report gives no detail on the flaw, affected products or fixes.
Who is affected. The source does not say which organisations are affected. It names the vendor Zyxel.
What to do. Check whether you run Zyxel devices, and read the vendor's own advisory for affected models and fixes.
When to act. For awareness: no known exploitation and no score stated
Editor's reading
Forasset ownerIT security
- Purdue level
- L3.5
Why: Zyxel network and remote-access devices typically sit at the boundary between office IT and plant networks.
- Are you exposed?
List Zyxel devices in your asset inventory and check which ones expose management or remote-access services to the internet.
- If you cannot fix it yet
- Limit who can reach Zyxel device management and remote-access services to known hosts.
- Require multi-factor authentication on any remote access through Zyxel devices.
- Watch for
- Unexpected logons or configuration changes on Zyxel network or remote-access devices.
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: shattered.io (via Google News) (opens news.google.com)
More on Zyxel