Hackers Exploit Zyxel GS1900 Zero-Day Vulnerability
Original title: Hackers Exploit Zyxel GS1900 Zero-Day Vulnerability to Compromise Nearly 1,000 Network Switches
Attackers compromised nearly 1,000 Zyxel GS1900 switches via pre-authentication RCE before Zyxel patched the flaw.
Attackers exploited a zero-day vulnerability in Zyxel GS1900 switches, compromising 996 devices across 48 countries before the vendor shipped a fix. The flaw allowed remote code execution, enabling configuration theft and credential access. GreyNoise linked activity to CVE-2026-7273; Zyxel confirmed a separate issue fixed on October 22.
- 996 switches compromised in 48 countries
- Two exploit modes: GOT overwrite and ASLR brute-force
- Vulnerable versions: 2.90(...).2 and earlier
- Fixed version: 2.90(...).3
Impact: remote code execution and configuration theft
- 1.Upgrade to Zyxel GS1900 release 2.90(...).3 or later
- 2.Restrict web management interface to dedicated admin networks
- 3.Rotate default and privileged credentials
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-107441 | Out-of-bounds write in Zyxel GS1900-24E CGI up to 2.90(AAHK.2)C0 | 8.8 | — | ||
| CVE-2026-7273 | Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability | 8.8 | 3% | KEVPoC | KEV |
From the original article
2 min read at gbhackers.com
Attackers used a pre-authentication remote code execution exploit against Zyxel GS1900 switches. They compromised nearly 1,000 devices before Zyxel patched the flaw. Binarly researchers found that the exploit abused a previously unknown bug, not the one Zyxel fixed in June.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.