Vulnerability · high
Zyxel GS1900 switch zero-day exploited, patch incomplete
Tier A · Patch today – Before you go home
Who’s exposed: GS1900 switches with reachable web management interfaces
Tier A because: Core infrastructure or popular tool AND exploited in the wild
Reach
Attack
Damage
Fix
Popular tool · Exploited in the wild · Remote, no login · Full takeover · Secrets exposed · No fix yet
The Brief
- Zyxel's earlier patch for an actively exploited GS1900 switch flaw is incomplete; Binarly found patched switches still open to the exploit.
- The exploit lets anyone who can reach a switch's web management interface run commands on it.
- Attackers compromised nearly 1,000 devices worldwide and stole configuration files and credentials; the flaw is tracked as CVE-2026-107441.
Why it matters
If your network includes Zyxel GS1900 switches with a reachable web management interface, a patch alone may not protect them, and compromised switches can expose configuration files and credentials.
The checklist behind the tier
Checklist · 7 of 10 yes
| Yes | Hits tech teams | Judgment: managed network switches are network infrastructure that IT teams build with and run. |
| No | Core infrastructure | Judgment: a single vendor's switch line is not software nearly every team runs. |
| Yes | Popular tool | Judgment: Zyxel GS1900 is a widely deployed business switch appliance, though not mainstream software. |
| Yes | Exploited in the wild | BleepingComputer: Zyxel zero-day exploited to hack nearly 1,000 network switches worldwide. |
| No | Public exploit | No source says exploit code or a step-by-step PoC is published. |
| Yes | Remote, no login | The Hacker News: anyone who can reach the web management interface can run commands; crafted HTTP requests (SecurityWeek). |
| Yes | Full takeover | The Hacker News: the exploit allows root command execution on the switch. |
| Yes | Secrets exposed | BleepingComputer: attackers stole configuration files and credentials from compromised switches. |
| No | Supply chain | Sources describe a flaw exploited in the device, not malicious code shipped through a trusted channel. |
| Yes | No fix yet | The Hacker News: GS1900 switches that received the earlier fix are still open to the exploit; the patch is incomplete. |
Timeline
Zyxel reported a patch for the zero-day exploited against GS1900 switches
BleepingComputer
Zyxel fixes zero-day exploited to hack nearly 1,000 network switches
Binarly found that switches with the earlier fix remain open to the exploit
The Hacker News
Zyxel GS1900 Patch Fails to Block Zero-Day Exploit Allowing Root Command Execution
SecurityWeek
Zyxel Switch Hacks Blamed on Patched Flaw Actually Exploited a Zero-Day
Full coverage · 3 sources
First seen · 3 sources · Full story page · How tiers are decided