Tag: zyxel
-
Zyxel Switch Patch Missed Flaw Behind Wave of Attacks
Zyxel’s June GS1900 patch did not block the exploit used against 996 switches, Binarly found First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/zyxel-gs1900-patch-missed-flaw/
-
Patched Zyxel GS1900 switches remained open to inwild exploit (CVE-2026-107441)
Zyxel GS1900 series network switches that received a fix for a flaw that was later reported to have been exploited in the wild are still open to an exploit attackers used, … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/11/05/zyxel-cve-2026-107441-exploit/
-
Zyxel GS1900 Patch Fails to Block Zero-Day Exploit Allowing Root Command Execution
Zyxel GS1900 network switches that received the vendor’s earlier fix for an actively exploited flaw are still open to the exploit attackers used, researchers at Binarly found.The exploit lets anyone who can reach a switch’s web management interface run commands on it without logging in. Zyxel has released new firmware for 10 GS1900 models that…
-
Hackers Exploit Zyxel GS1900 Zero-Day Vulnerability to Compromise Nearly 1,000 Network Switches
Tags: authentication, cyber, exploit, hacker, network, remote-code-execution, vulnerability, zero-day, zyxelAttackers used a pre-authentication remote code execution exploit against Zyxel GS1900 switches. They compromised nearly 1,000 devices before Zyxel patched the flaw. Binarly researchers found that the exploit abused a previously unknown bug, not the one Zyxel fixed in June. GreyNoise reported that around August 17, an actor exploited 996 GS1900 switches across 48 countries.…
-
Hackers Exploit Zyxel GS1900 Zero-Day Vulnerability to Compromise Nearly 1,000 Network Switches
Tags: authentication, cyber, exploit, hacker, network, remote-code-execution, vulnerability, zero-day, zyxelAttackers used a pre-authentication remote code execution exploit against Zyxel GS1900 switches. They compromised nearly 1,000 devices before Zyxel patched the flaw. Binarly researchers found that the exploit abused a previously unknown bug, not the one Zyxel fixed in June. GreyNoise reported that around August 17, an actor exploited 996 GS1900 switches across 48 countries.…
-
Zyxel fixes zero-day exploited to hack nearly 1,000 network switches
Zyxel has patched a zero-day vulnerability in its GS1900 series network switches that hackers exploited to compromise nearly 1,000 devices worldwide and steal configuration files and credentials. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/zyxel-fixes-zero-day-exploited-to-hack-nearly-1-000-network-switches/
-
EUVD-2026-37030 / CVE-2026-7273 – Angriffe aus dem lokalen Netzwerk auf Zyxel-Switches
First seen on security-insider.de Jump to article: www.security-insider.de/zyxel-gs1900-cve-2026-7273-aktive-ausnutzung-a-f70c3ca42e1108342f52f0d3bb96dddd/
-
Chinese hackers exploit WordPress, Zyxel flaws to steal govt data
A Chinese-speaking threat actor has been exploiting vulnerabilities in ZyXEL GS1900 Smart Managed Switches and WordPress to steal sensitive data from 996 devices and more than 18,500 records stored in backend databases. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/chinese-hackers-exploit-multiple-technologies-to-steal-govt-data/
-
Attacker compromised nearly 1000 Zyxel switches since August (CVE-2026-7273)
A Chinese-speaking threat actor has exploited a vulnerability (CVE-2026-7273) in unpatched ZyXEL GS1900 Smart Managed Switches and has exfiltrated sensitive data from 996 … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/09/22/zyxel-switches-cve-2026-7273-vulnerability-exploited/
-
U.S. CISA adds Zyxel flaw to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Zyxel flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Zyxel GS1900 Series Switches flaw, tracked as CVE-2026-7273 (CVSS score of 8.8), to its Known Exploited Vulnerabilities (KEV) catalog. The flaw is a stack-based buffer overflow that could allow attackers…
-
U.S. CISA adds Zyxel flaw to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Zyxel flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Zyxel GS1900 Series Switches flaw, tracked as CVE-2026-7273 (CVSS score of 8.8), to its Known Exploited Vulnerabilities (KEV) catalog. The flaw is a stack-based buffer overflow that could allow attackers…
-
U.S. CISA adds Zyxel flaw to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Zyxel flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Zyxel GS1900 Series Switches flaw, tracked as CVE-2026-7273 (CVSS score of 8.8), to its Known Exploited Vulnerabilities (KEV) catalog. The flaw is a stack-based buffer overflow that could allow attackers…
-
U.S. CISA adds Zyxel flaw to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Zyxel flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Zyxel GS1900 Series Switches flaw, tracked as CVE-2026-7273 (CVSS score of 8.8), to its Known Exploited Vulnerabilities (KEV) catalog. The flaw is a stack-based buffer overflow that could allow attackers…
-
CISA orders feds to patch Zyxel flaw exploited for data theft
Attackers are now actively exploiting a high-severity vulnerability in Zyxel GS1900 series switches, according to the U.S. Cybersecurity and Infrastructure Security Agency (CISA). First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-actively-exploited-zyxel-flaw-by-thursday/
-
CISA Flags Actively Exploited Flaw in Zyxel GS1900 Switches
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has included a high-severity vulnerability affecting Zyxel GS1900 Series switches in its Known Exploited Vulnerabilities (KEV) Catalog. This warning highlights that the flaw, tracked as CVE-2026-7273, has been exploited in the wild. The vulnerability stems from a stack-based buffer overflow in the device’s CGI program. CISA added…
-
Zyxel and Veeam Flaws Under Active Exploitation With Command and SYSTEM Access
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a now-patched security flaw impacting Zyxel GS1900 series switches to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.The vulnerability, tracked as CVE-2026-7273 (CVSS score: 8.8), is a stack-based buffer overflow vulnerability that could result in arbitrary operating First seen on thehackernews.com…
-
Zyxel and Veeam Flaws Under Active Exploitation With Command and SYSTEM Access
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a now-patched security flaw impacting Zyxel GS1900 series switches to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.The vulnerability, tracked as CVE-2026-7273 (CVSS score: 8.8), is a stack-based buffer overflow vulnerability that could result in arbitrary operating First seen on thehackernews.com…
-
Zyxel Vulnerabilities Allow Remote Attackers to Execute Commands via Command Injection
Zyxel has rolled out critical security patches for multiple vulnerabilities affecting its 4G LTE/5G NR CPE, DSL/Ethernet CPE, Fiber ONTs, Security Routers, and Wireless Extenders. The flaws range from null pointer dereferences causing Denial-of-Service (DoS) to severe command injections allowing remote attackers to execute system commands. CVE ID Severity Vulnerability Type Attack Vector Impact CVE-2025-13942…
-
Critical Zyxel router flaw exposed devices to remote attacks
Tags: attack, cve, data-breach, flaw, injection, remote-code-execution, router, vulnerability, zyxelZyxel fixed a critical flaw in multiple routers that lets unauthenticated attackers remotely execute commands on vulnerable devices. Zyxel addressed a critical remote code execution vulnerability, tracked as CVE-2025-13942 (CVSS score of 9.8), affecting more than a dozen router models. A command injection flaw in the UPnP feature of several Zyxel CPEs, Fiber ONTs, and…
-
Zyxel warns of critical RCE flaw affecting over a dozen routers
Taiwan networking provider Zyxel has released security updates to address a critical vulnerability affecting over a dozen router models that can allow unauthenticated attackers to gain remote command execution on unpatched devices. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/zyxel-warns-of-critical-rce-flaw-affecting-over-a-dozen-routers/
-
Partnerschaft – Zyxel bindet Avast-Endpunktschutz in USG-Flex-H-Firewalls ein
First seen on security-insider.de Jump to article: www.security-insider.de/zyxel-bindet-avast-endpunktschutz-in-usg-flex-h-firewalls-ein-a-306b599d7f5ea3e933a222bb60f8744e/
-
Partnerschaft – Zyxel bindet Avast-Endpunktschutz in USG-Flex-H-Firewalls ein
First seen on security-insider.de Jump to article: www.security-insider.de/zyxel-bindet-avast-endpunktschutz-in-usg-flex-h-firewalls-ein-a-306b599d7f5ea3e933a222bb60f8744e/
-
Partnerschaft – Zyxel bindet Avast-Endpunktschutz in USG-Flex-H-Firewalls ein
First seen on security-insider.de Jump to article: www.security-insider.de/zyxel-bindet-avast-endpunktschutz-in-usg-flex-h-firewalls-ein-a-306b599d7f5ea3e933a222bb60f8744e/
-
Partnerschaft ermöglicht VPN-Service ohne zusätzliche Kosten – Zyxel und Tailscale vereinfachen die sichere Remote-Konnektivität
First seen on security-insider.de Jump to article: www.security-insider.de/zyxel-und-tailscale-vereinfachen-die-sichere-remote-konnektivitaet-a-5ce2ec60281cf29159b26db40ee6033b/
-
Zyxel Devices Hit by Active Exploits Targeting CVE-2023-28771 Vulnerability
Zyxel users beware: A critical remote code execution flaw (CVE-2023-28771) in Zyxel devices is under active exploitation by a Mirai-like botnet. GreyNoise observed a surge on June 16, targeting devices globally. First seen on hackread.com Jump to article: hackread.com/zyxel-devices-active-exploits-cve-2023-28771-vulnerability/
-
Critical Zyxel vulnerability under active exploitation after long period of quiet
Researchers say a sudden burst of activity could be linked to a Mirai botnet variant. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/vulnerability-zyxel-exploitation/750922/
-
Attackers target Zyxel RCE vulnerability CVE-2023-28771
GreyNoise researchers have observed exploit attempts targeting the remote code execution vulnerability CVE-2023-28771 in Zyxel devices. On June 16, GreyNoise researchers detected exploit attempts targeting CVE-2023-28771 (CVSS score 9.8), a remote code execution flaw impacting Zyxel IKE decoders over UDP port 500. >>Exploitation attempts against CVE-2023-28771 were minimal throughout recent weeks.On June 16, GreyNoise observed…
-
Zyxel Devices Under Attack as Hackers Exploit UDP Port RCE Flaw
Tags: attack, control, cve, cyber, cyberattack, exploit, firewall, flaw, hacker, Internet, rce, remote-code-execution, vpn, vulnerability, zyxelA sudden and highly coordinated wave of cyberattacks has struck Zyxel firewall and VPN devices worldwide, as hackers exploit a critical remote code execution (RCE) vulnerability tracked as CVE-2023-28771. The attacks, observed on June 16, 2025, leveraged UDP port 500″, the Internet Key Exchange (IKE) packet decoder”, to remotely inject system commands and potentially seize…
-
Mirai botnet weaponizes PoC to exploit Wazuh open-source XDR flaw
Two Mirai variants integrate the exploit: The first botnet exploiting CVE-2025-24016 was detected by Akamai in March and used a proof-of-concept (PoC) exploit that was published for the vulnerability in late February. That exploit targets the /security/user/authenticate/run_as API endpoint.The second botnet was detected in early May and targeted the /Wazuh endpoint, but the exploit payload…
-
Zyxel RCE Flaw Lets Attackers Run Commands Without Authentication
Tags: authentication, cyber, exploit, firewall, flaw, network, rce, remote-code-execution, vulnerability, zyxelSecurity researcher Alessandro Sgreccia (aka >>rainpwn