Networking equipment giant Zyxel warns customers of a series of attacks that have been targeting some of its enterprise firewall and VPN server solutions. The company states that devices running the Nebula cloud management mode are not impacted. The vendor reported that attackers are attempting to access network devices through WAN. Upon accessing the devices, attackers then bypass authentication and establish SSL VPN tunnels with unknown user accounts (i.e. zyxel_slIvpn, zyxyl_ts) to manipulate the devices configuration. It is not clear if the hackers breached one of the customers of the vendor.”]
Source: https://securityaffairs.co/wordpress/119351/hacking/zyxel-firewall-vpn-attacks.html