Zyxel GS1900 switches remain vulnerable to root command execution
Original title: Zyxel GS1900 Patch Fails to Block Zero-Day Exploit Allowing Root Command Execution
Zyxel GS1900 Patch 2 fails to block zero-day allowing unauthenticated root access; Patch 3 fixes CVE-2026-107441
Binarly researchers found Zyxel GS1900 network switches patched for CVE-2026-7273 remain open to zero-day exploits that allow anyone to reach the web interface and run commands as root. GreyNoise reported attackers stole data from 996 switches in August. Zyxel released Patch 3 on October 23 fixing the new flaw in all models.
Unconfirmed: Whether CVE-2026-107441 was exploited in the GreyNoise attacks is unconfirmed
- Exploit confirmed to work on Patch 2 firmware for all 10 GS1900 models
- GreyNoise tied attacks to Red Heron group
- CVSS 9.8 per researchers vs 8.8 by vendor
- No workaround provided for unpatched switches
- Exploits download data-collection script and steal configs plus hashed credentials
Impact: unauthenticated root command execution
- 1.Update to Patch 3 firmware for your specific model
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-107441 | Out-of-bounds write in Zyxel GS1900-24E CGI up to 2.90(AAHK.2)C0 | 8.8 | — | ||
| CVE-2026-7273 | Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability | 8.8 | 3% | KEVPoC | KEV |
From the original article
4 min read at thehackernews.com
Zyxel GS1900 network switches that received the vendor's earlier fix for an actively exploited flaw are still open to the exploit attackers used, researchers at Binarly found. The exploit lets anyone who can reach a switch's web management interface run commands on it without logging in. Zyxel has released new firmware for 10 GS1900 models that closes the hole.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.