Zyxel Switch Hack: Who Owns the Box in Your NC Closet?

The short version: On or about August 17, one operator exploited 996 Zyxel GS1900 switches across 48 countries and took their configurations, networking information and hashed root credentials, according to GreyNoise's September 21 report. Zyxel shipped the fix on June 16. CISA listed the flaw as exploited on September 21, federal deadline September 24. The GS1900 is an entry-level managed switch bought by the box, which is why this lands in High Point and not only in Washington.

Walk to the closet by the break room, or the gray cabinet outside the paint line. Inside is a switch with blinking lights that somebody installed, plugged in, and never touched again.

Ask your IT provider one question about it: what firmware is on it, and when was that applied? The answer tells you more about your network than any assessment report will.

Key takeaway: Firewalls get patched because somebody owns them. Switches do not get patched because nobody does. That gap is not a technology problem, it is an ownership problem, and it is why a June fix was still missing from a thousand switches in August.

Not sure who owns your switch firmware? Preferred Data Corporation is in High Point and answers the phone at (336) 886-3282.

Is this our switch, and how do I tell without calling anyone?

Read the whole model string off the front bezel, suffix included, and match it against this table. Do not stop at "GS1900". Zyxel's advisory of June 16, 2026 names ten models and no others, and the suffix decides: a GS1900-24HPv2 is listed, a GS1900-24HP is not. If your string is not in the left column, this advisory does not cover your unit and its firmware is not yours to flash. Read Zyxel's assurance precisely, though: it says "on-market products not listed in the table remain unaffected." A GS1900 that is past end of support is outside the table and outside that assurance, so treat it as replace-or-isolate rather than as confirmed safe:

Read that table the safe way round. You are patched if your string is the right-hand build for your exact model, or a later Zyxel release for that model. Anything earlier is unpatched, including 2.80 and 1.x builds that resemble neither column. Do not pattern-match a build suffix across models, and do not assume a 2.90 build is current, because the vulnerable build and the fix are both 2.90.

The HP and EP models feed your access points, cameras and VoIP phones over Power over Ethernet, which makes them the boxes everything else hangs off and the ones nobody wants to reboot mid-shift.

On a switch you can already log into, the check is about five minutes. If you cannot get in, read the next section before budgeting anything, because that case dominates the schedule:

1. Get the model number off the label, not off a spreadsheet.
2. Log into the web interface and read the running firmware string.
3. Match it against the table above, for that model only.
4. While you are in there, find out whether the admin password is still 1234, which Zyxel confirms is the factory default for a standalone-mode switch.

What if nobody here knows the switch password?

This is the most common answer we get, and not a failure on your part. The credential was set by a cabling contractor in 2019, or never changed, and whoever would know has retired. If it turns out to still be 1234, that is both the good news and the finding.

If nobody can get in at all, be careful what you agree to. On the GS1900 the recovery path is the front-panel Reset or Restore button held for more than six seconds, and Zyxel's own answer is that this clears the switch back to factory defaults. That wipes the VLANs, port configuration and uplinks along with the password, and everything behind the switch drops until someone rebuilds it. Plan it as an outage with a written config to restore from. If you have no copy of the config, getting one is the first task, ahead of the reset.

What actually happened on August 17?

GreyNoise obtained the attacker's exploit script, deobfuscated it and decompiled the bytecode, and found its sole purpose was exploiting this flaw. It describes the operator as "a suspected Chinese speaker possibly working in UTC+8 based on the operational timeline and copious amounts of Chinese language comments contained within their custom tools and scripts," and links the activity to an adversary "the same or related to 'Red Heron' reported on by Acronis." That is as far as attribution goes.

Sit with the victim breakdown. 996 devices across 48 countries, heaviest in Italy at 133, the US at 129 and Taiwan at 123. Of those, GreyNoise reports 564 "had factory default credentials" still in place: roughly 57 percent of a global victim set that had never changed the password on a switch carrying its whole network.

Sixty-two days separate the fix from the raid. That window is the finding, and it is not a Zyxel story. It is the firmware cadence on any device that arrived in a box, got racked, and never entered anybody's inventory.

"LAN-based only" sounds like it does not reach us. Does it?

This is the part most coverage goes soft on, so here is the honest version. Zyxel and CISA both describe the attacker as "LAN-based," and the CVE is scored 8.8 with an attack vector of Adjacent Network, written AV:A in the vector string, which means the attacker has to already be on a network that can reach the switch management interface rather than out on the open internet.

Neither GreyNoise nor CISA has published how the operator reached a thousand of these devices, and we are not going to invent a path. What we can say is what "adjacent" buys an attacker on the networks we actually walk into at 20-to-250-person manufacturers around the Piedmont Triad.

On a flat network, adjacent means everything. The contractor laptop that was here for a week. The vendor's remote-support session into the label printer. The conference-room drop a sales rep found. The camera NVR still running Windows 7. Any one of those, once it misbehaves, sits on the same broadcast domain as the switch management interface, and AV:A stops being a mitigation and starts being a description of your Tuesday.

Here is what we see when we take over a plant network in Greensboro or Thomasville: nobody can produce the switch list. The firewall has an owner, a support contract and a renewal date. The switches have a purchase order from 2019 and a person who has since retired. A cheap switch never generates an invoice, and your accounting system is your de facto asset inventory, so it fell off the books in year one. That asymmetry is the vulnerability, and one patch does not close it.

See how we handle network infrastructure for NC manufacturers.

What did they take, and why is patching not the end of it?

Configuration files, networking information and hashed root-level credentials. A switch config is a map: VLANs, subnets, trunk ports, uplinks, SNMP community strings, syslog destinations. It tells someone who has never been in your building how your building is wired. Hashes get cracked offline at leisure, and for the 564 victims on the factory default there was nothing to crack.

One clarification, because coverage welds these together. The flaw is pre-authentication: the CVSS vector reads PR:N, and Zyxel describes an "unauthenticated attacker." Default passwords did not let anyone in. They made the stolen credential file immediately useful afterward, which is why patching alone does not finish the job.

CISA reached the same conclusion. The KEV entry for CVE-2026-7273 carries a forensicTriage flag of Yes: the required action is to apply the vendor fix and carry out forensic triage under BOD 26-04. CISA records known ransomware campaign use for this CVE as "Unknown," so nobody is claiming a ransomware link, and neither are we.

That last row is the one nobody schedules, because it needs an outage window and a named owner, and it is the one with the widest forward value: it reduces exposure to any future flaw that needs network reach to the management interface. The rows above it have forward value too, just narrower. A changed admin credential blocks a future authenticated flaw; a rotated SNMP string constrains one that abuses SNMP. Be clear what isolation buys: it does not remove adjacency, it shrinks the set of machines that have it, and a compromised admin workstation that legitimately reaches the management VLAN is still adjacent.

What should an NC plant actually do this week?

If you read one paragraph: patch against the table above, rotate credentials in the same window, and treat the configuration as disclosed. Then do the boring part, which is building the inventory that would have caught this in June.

1. Inventory every managed switch by full model and firmware string. Walk the closets, or send someone who will photograph every label.
2. Patch the GS1900 units to their model's build. Get the image from Zyxel, not a third-party mirror: the advisory says to contact your local service representative or use Zyxel's Community. A PoE reboot drops phones, cameras and access points, so do it when the line is down, not at 10 a.m. Do not interrupt power while the image is writing. Get a per-switch time estimate before you buy the window from your owner.
3. Change the local admin credential on every switch. The Zyxel units are where you start, not where you stop. If 1234 survived here, check the rest.
4. Rotate anything the configuration held. SNMP community strings and shared secrets in a switch config should be treated as published.
5. Put switch management interfaces on their own VLAN a shop-floor PC cannot reach. This shrinks the set of machines that can reach the flaw; it does not empty it.
6. Put switch firmware on the same patch calendar as your servers. If your provider's patch report has no network-hardware section, ask why.
7. Set a replacement date for anything past support. Firmware fixes stop arriving eventually, and a switch with no future patches is a scheduled problem rather than a surprise.

If steps one and seven are the ones you cannot staff, that is the normal answer, and it is the work we do. Call (336) 886-3282, or tell us what is in your closets.

Why does this keep happening to small manufacturers?

Because the economics of cheap network gear select for it. The switch works and asks nothing of you after installation. No renewal notice, no license expiry, no account manager calling. Short of it failing outright, the signal that it needs attention is a vendor advisory in an inbox nobody reads.

Preferred Data Corporation has done industrial and manufacturing IT in High Point since 1987, which is 39 years, and the pattern has held across all of them. We have pulled Netgear and TP-Link units out of NC plants running firmware years out of date. The brand changes; the closet does not. Our clients stay an average of more than 20 years, and much of that work is the unglamorous part: knowing what is installed and when it was last touched. We work on site within 200 miles of High Point, covering Greensboro, Winston-Salem, Charlotte and Raleigh.

The switch in the closet does not care whether you are in Wilmington or Winston-Salem. It cares whether anyone has its firmware version written down.

Want somebody to own that list? Call (336) 886-3282. We start with the closets.

Managed IT services for NC manufacturers | Cybersecurity and 24/7 monitoring | Hardware procurement and refresh planning

Questions NC plant managers are asking this week

We do not have Zyxel switches. Are we done?

No. This CVE does not apply, but the question behind it does. Ask your provider for one list covering every switch, access point and firewall, with model, firmware and the date applied. If that list does not exist, that is the finding, and it applies to Netgear, TP-Link, Ubiquiti and Cisco Small Business gear as much as to Zyxel.

Is my switch reachable from the internet?

Probably not by design, and verify rather than assume. The flaw is scored as Adjacent Network, so the attacker needs reach to the management interface. If that interface shares a VLAN with user PCs, anything that compromises a PC has it. Check which VLAN your management addresses live on.

We patched. Do we still need to change passwords?

Yes. Configurations and hashed root credentials were taken. Patching closes the door; it does not retrieve what left through it. Rotate the admin credential and anything else the configuration held.

Does the CISA deadline apply to a private company in North Carolina?

Not as a general business, no. BOD 26-04 binds federal civilian agencies, and states it "does not apply to contractors" unless the procurement contract says otherwise. The nuance matters if you do federal work: the directive covers federal information systems operated "by another entity on behalf of an agency," and agencies must review contracts for the changes needed to comply. If you operate anything on an agency's behalf, read your contract rather than this paragraph. Otherwise the federal date is a benchmark, not an obligation.

How do I know if we were one of the 996?

You likely cannot tell from the switch alone, which is why the federal required action is to apply the vendor fix and carry out forensic triage, not one or the other. It does not bind you, but it is the right standard to borrow. Look for management-interface access from unexpected sources in any syslog you kept from mid-August. No switch syslog is itself a finding.

Should we replace these switches or just patch them?

Patch now, decide replacement separately. Replacement is a budget conversation about support lifetime and PoE headroom. Patching is a today conversation. Do not let the second delay the first.

Related Resources

• Network infrastructure design and management for NC plants
• Cybersecurity services and 24/7 monitoring
• MikroTik Router Hijack Alert: NC Branch Network Risk
• UniFi OS CVE-2026-34908 CVSS 10: NC SMB Network Defense Plan
• Network Segmentation for Manufacturers: Isolating OT from IT in NC Plants
• Salt Typhoon Hits 200 Companies: NC SMB Edge Defense 2026