Zyxel GS1900 Patch Failed: Check Your Office Switches Now
By Ruben Selby, Founder and Lead Security Consultant, Wolfcore
Researchers say the first Zyxel GS1900 patch, for a flaw in these network switches, did not stop the exploit. A second fix, called Patch 3, is out for 10 models. If you have one of these small grey boxes in a comms cupboard, ask your IT person today which firmware it runs.
What happened with the Zyxel GS1900 patch
Binarly found that GS1900 switches on the 2.90 Patch 2 firmware are still open to the exploit that was used in attacks, according to The Hacker News. The exploit lets someone who can reach the switch’s web management page run commands without logging in. Zyxel’s advisory of 3 November lists 10 affected models and the fixed Patch 3 firmware for each. GreyNoise reported that around 17 August an attacker took data from 996 GS1900 switches in 48 countries, 33 of them in the United Kingdom. Data included configurations and hashed root credentials. Of the 996, 564 still used factory default credentials. Neither report says the attacked switches ran Patch 2, and Zyxel does not say whether the new flaw has been exploited.
Why it matters if you run a small or mid-sized business
A switch is not a glamorous asset. Nobody logs into it for months. That is exactly why it gets forgotten.
Three things went wrong here, and none of them is unique to Zyxel.
First, the earlier fix did not close the hole. Binarly says Patch 2 added a check, but the check ran too late to help. The lesson is simple. “Patched” is a claim until someone confirms the hole is shut. Updating a version number and testing that the weakness has gone are different jobs.
Second, the management page was reachable. The exploit needs network access to the switch’s web interface. Binarly says reachability is enough. Zyxel describes a LAN-based attacker. Either way, that page should not be open to the internet, and on a flat office network it should not be open to every laptop and guest phone either.
Third, factory default credentials. More than half of the compromised switches still used them, according to GreyNoise. Defaults are public knowledge. They turn a stolen password hash into a quick win.
A switch sits in the middle of your traffic. A compromised one gives an attacker a quiet foothold, and laptop security tools often do not watch it. Zyxel’s advisory also gives no workaround and does not say what to check if a switch may already have been compromised. So treat this as a job for this week, not the next maintenance window. Our patch management guide explains the basics.
What to do this week
- Ask your IT person or supplier to list every Zyxel switch you own, including ones in shops, depots and branch offices, and note the model and firmware version of each.
- Compare each GS1900 model against the table in Zyxel’s advisory and install the Patch 3 firmware where it applies.
- Check that the switch’s web management page cannot be reached from the internet, and limit it to one admin network or a small set of admin devices.
- Change any factory default or shared password on every switch, and store the new one in your password manager.
- If a switch was exposed or on default credentials, ask your IT person to treat its stored configuration and credentials as exposed, change them, and review the switch for anything unexpected.
FAQ
Is the Zyxel GS1900 Patch 2 firmware still vulnerable? Binarly says GS1900 switches on the 2.90 Patch 2 firmware are still open to the exploit used in attacks. Zyxel has released Patch 3 for 10 models.
Should a switch’s web management page be open to the internet? No. The exploit needs network access to that page, so keep it off the internet and limit it to an admin network or a small set of admin devices.
What should I do about default passwords on switches? Change any factory default or shared password on every switch. GreyNoise reported that 564 of the 996 switches it saw data taken from still used factory default credentials.
How Wolfcore helps
Most firms run a scanner and send a report (see how a scan differs from a penetration test). We simulate an attacker, which includes asking whether a “fixed” device really is. Our pricing and retainers page shows how a security retainer keeps that testing going all year, and a one-off penetration test can check your network and exposed services. You can also book a conversation. For your public website, start with our free web vulnerability scan. Wolfcore is Cyber Essentials certified.