Zyxel patches zero-day vulnerability in GS1900 series switches

Zyxel has released firmware updates to address a critical zero-day vulnerability affecting ten models within its GS1900 series of switches. The flaw allows remote attackers to execute arbitrary code without authentication by sending a specially crafted HTTP request.

Security researchers and reports indicate that a cyber threat group, identified as Kapibala, exploited this vulnerability to compromise 996 devices across 48 countries. The campaign, which began around August 17, targeted small to medium-sized enterprises, including offices, schools, and hotels.

Victims reported the theft of device configurations, network information, and hashed root credentials. In at least 564 cases, attackers were able to exploit devices still using factory default passwords. The vulnerability remained effective even after a previous patch was issued in June, as the new exploit targeted a different aspect of the management component.