Zyxel GS1900 Switch Zero-Day Exploited Against Nearly 1,000 Devices

Key points

• Unknown actors exploited a previously undisclosed flaw in Zyxel GS1900 switches.
• Almost 1,000 devices worldwide showed signs of compromise.
• Attackers harvested login credentials and configuration files.
• Zyxel has released a firmware update; no CVE identifier is listed.

Zyxel GS1900 switches have been targeted in a global campaign that compromised close to one thousand units, according to the facts available. The attackers remain unidentified, and the intrusion relied on exploiting a vulnerability that was not publicly known at the time. No CVE identifier has been associated with the issue, which complicates tracking and vulnerability-management workflows.

The impact goes beyond a single device outage. Attackers were able to compromise the switches themselves, harvest login credentials, and take configuration files. For network teams, that combination is especially concerning: switches sit beneath much of the access layer, and stolen credentials or configuration data can expose management paths, trust relationships, and network design details that support follow-on activity.

Organizations running Zyxel GS1900 hardware should assume that any exposed management interface is a potential entry point until proven otherwise. K-12 environments with distributed campuses, closets, and limited on-site staff are particularly exposed when switch management is reachable from untrusted networks or shared across sites.

Zyxel has issued a patch, but the absence of a CVE means defenders cannot rely on standard advisory feeds alone. The window between zero-day exploitation and patch availability is exactly when attackers have the advantage, so inventory and verification matter as much as installation.

What to watch: unexpected configuration changes, unusual administrative logins, outbound connections from switch management interfaces, and any sign that credentials or configuration backups have been accessed. Treat the patch as urgent, then validate that no persistence or credential misuse remains.

What to do now

1. Inventory every Zyxel GS1900 switch in use, including remote sites, and identify which management interfaces are reachable from untrusted networks.
2. Apply the vendor firmware update immediately; where patching must wait, isolate affected switches and restrict management access to trusted VLANs or jump hosts.
3. Rotate administrative, SNMP, RADIUS/TACACS, and any shared service credentials that may have been stored on or used by the switches.
4. Compare current configurations against known-good baselines and restore any unauthorized changes; review configuration export activity.
5. Hunt logs for anomalous logins, configuration downloads, firmware changes, and outbound connections from switch management addresses.
6. Disable WAN-side administration and enforce least-privilege access with unique accounts per administrator.
7. Monitor Zyxel advisories and internal telemetry for a CVE assignment or updated guidance, and report suspected compromises to incident response.

Original source

BleepingComputer