Zyxel Patches GS1900 Switch Zero-Day After Nearly 1,000 Devices Compromised

What happened

Zyxel has released a patch for a zero-day vulnerability in its GS1900 series network switches, according to BleepingComputer. Attackers exploited the flaw to compromise close to 1,000 devices worldwide. They reportedly stole configuration files and credentials from affected switches. The available reporting did not include the vulnerability vector, authentication requirements, or a CVE identifier.

Why it matters

Network switches sit at a privileged point in the infrastructure. A compromise can expose stored credentials, VLAN and routing configuration, and SNMP or management-plane access. Attackers can use that access to pivot further into a network or reuse credentials elsewhere. Management interfaces on switching hardware are often less monitored than servers and endpoints. A stolen configuration file can reveal both topology and secrets at once. Organizations running Zyxel GS1900 switches should treat this as a priority patching item, especially where management interfaces are internet-facing or loosely segmented.

What defenders should do now

• Identify any Zyxel GS1900 series switches in your environment and apply the vendor patch once it is validated for your deployment.
• Confirm management interfaces (web UI, SNMP, SSH/Telnet) are not exposed directly to the internet, and restrict access to trusted management networks only.
• Rotate credentials and review configuration files on affected or potentially affected switches, since both were reportedly targeted.
• Review switch logs and management-plane audit trails for unexpected configuration changes, unfamiliar admin logins, or firmware/config exports.
• Where supported, enable multi-factor authentication or IP allow-listing for switch management access, and ensure default or weak credentials are not in use.

Developing story

The exact exploitation technique and a formal CVE assignment have not yet been confirmed in public reporting. We will update coverage as more technical details emerge. Read the original report at BleepingComputer.