WORLDTECHZyxel patches zero-day exploited to compromise nearly 1,000 GS1900 switches
Zyxel has patched a zero-day vulnerability in its GS1900 series network switches, a flaw that attackers were already using before a fix existed. The intrusions reportedly compromised nearly 1,000 devices worldwide and allowed the theft of configuration files and credentials.
How the attackers got in
The attackers used a pre-authentication remote code execution exploit against the GS1900 switches, meaning the attack required no valid login to run code on the device.
Before Zyxel released a fix, the exploit had already been used to compromise nearly 1,000 switches.
Different bug than the June fix
Researchers at Binarly found that the exploit abused a previously unknown bug. It was not the flaw Zyxel had addressed in June, which means the earlier patch did not close this route into the devices.
GreyNoise reported that around August 17 an actor exploited 996 GS1900 switches across 48 countries, placing the campaign's reach well beyond a single region.
What was taken
According to the reporting, the compromised switches gave the attackers access to configuration files and credentials, information that can be used to move further into the networks the devices serve.
Open questions
- Which organisations operated the compromised switches?
- Has the patch been applied to all affected GS1900 devices?