Security · High impactFan score 73 · Tier A3 sources
Zyxel GS1900 Patch Fails to Block Zero-Day Exploit Allowing Root Command Execution
The Hacker News · By info@thehackernews.com (The Hacker News) ·
Zyxel GS1900 network switches that received the vendor's earlier fix for an actively exploited flaw are still open to the exploit attackers used, researchers at Binarly found. The exploit lets anyone who can reach a switch's web management interface run commands on it without…
The Brief
- Zyxel's earlier patch for an actively exploited GS1900 switch flaw is incomplete; Binarly found patched switches still open to the exploit.
- The exploit lets anyone who can reach a switch's web management interface run commands on it.
- Attackers compromised nearly 1,000 devices worldwide and stole configuration files and credentials; the flaw is tracked as CVE-2026-107441.
Why it matters
If your network includes Zyxel GS1900 switches with a reachable web management interface, a patch alone may not protect them, and compromised switches can expose configuration files and credentials.
Who’s affected
- Teams running Zyxel GS1900 series switches
- Network administrators with GS1900 web management interfaces reachable from untrusted networks
What to do
- Restrict access to the GS1900 web management interface so it is not reachable from untrusted networks
- Check GS1900 switches for signs of compromise and review stored configuration files and credentials
- CVE-2026-107441
- #zyxel
- #network-security
- #zero-day
- #command-injection
- #switches
- #vulnerability
Timeline
Zyxel reported a patch for the zero-day exploited against GS1900 switches
BleepingComputer
Zyxel fixes zero-day exploited to hack nearly 1,000 network switches
Binarly found that switches with the earlier fix remain open to the exploit
The Hacker News
Zyxel GS1900 Patch Fails to Block Zero-Day Exploit Allowing Root Command Execution
SecurityWeek
Zyxel Switch Hacks Blamed on Patched Flaw Actually Exploited a Zero-Day
