Zyxel has released a security fix for a zero-day vulnerability affecting GS1900 series network switches, after the flaw was reportedly exploited in attacks against nearly 1,000 devices exposed online. According to the report, the attacks were used to steal configuration files and credentials from affected switches.

For businesses, this is a reminder that network infrastructure devices such as switches, firewalls and routers can become direct attack targets when they are exposed to the internet or left unpatched. Even when a switch is not a customer-facing system, a compromise can provide attackers with valuable network information and access credentials that may support wider intrusion attempts.

What happened

Zyxel patched a zero-day vulnerability in its GS1900 series switches after active exploitation was reported. A zero-day is a security flaw that is exploited before a patch is widely available. In this case, the reported attacks affected close to 1,000 devices globally and involved theft of configuration files and login credentials.

The source report indicates that the compromised devices were internet-exposed. Configuration files on network equipment can contain sensitive operational details, including network settings, administrative information and other data useful to attackers. Stolen credentials may also create follow-on risks if the same passwords were reused elsewhere in an organisation’s infrastructure.

Why it matters for European businesses

Many SMEs and multi-site organisations rely on Zyxel equipment in offices, shops, warehouses and branch networks because it is widely used in cost-sensitive business environments. That makes this issue relevant not only to large enterprises but also to smaller companies with limited in-house security resources.

The practical risk is broader than the affected switch itself. If attackers obtain administrative credentials or network configuration data, they may be able to map internal environments more easily, target connected systems, attempt credential reuse or disrupt business operations. For e-commerce businesses, retailers and service companies, network downtime or unauthorised access to internal infrastructure can affect websites, order processing, customer support and day-to-day business continuity.

This also highlights an often overlooked security gap: infrastructure management interfaces should generally not be directly reachable from the public internet unless there is a clear operational reason and strong access controls in place.

Who may be affected

• SMEs and branch-based businesses using Zyxel GS1900 switches in offices, retail locations or distributed sites
• IT teams and managed service providers responsible for patching and monitoring network infrastructure
• E-commerce and digital businesses that depend on stable internal networking for fulfilment, support and business systems
• Organisations with internet-exposed device management interfaces, especially where remote administration is enabled
• Companies with weak credential hygiene, where passwords may be reused across network and administrative systems

What companies should consider

• Identify affected devices and confirm whether any GS1900 series switches are deployed in your environment
• Apply Zyxel’s security updates promptly in line with the vendor’s guidance
• Check whether management interfaces are exposed to the internet and restrict access where possible through VPNs, IP allowlisting or internal-only administration
• Rotate administrative credentials for affected devices, especially if there is any possibility that configuration files or passwords were exposed
• Review logs and device activity for signs of unauthorised access, unexpected configuration changes or unknown administrator sessions
• Assess password reuse risk if credentials stored on the switch may also have been used on other systems
• Include network equipment in patch management routines, not only servers, endpoints and cloud applications
• Work with your IT provider or security partner if you lack visibility into branch-office or legacy networking hardware

While the available reporting focuses on Zyxel GS1900 switches, the broader lesson is relevant across vendors: internet-facing infrastructure devices are high-value targets, and delayed patching can create disproportionate business risk.