Zyxel GS1900 Patch Fails to Block Zero-Day Exploit Allowing Root Command Execution
Summary: Researchers at Binarly found that Zyxel GS1900 switches running the vendor's 2.90 Patch 2 firmware, issued for CVE-2026-7273, remain exploitable by the same attack, which lets anyone with network reachability to the web management interface run commands as root without logging in. Zyxel released 2.90 Patch 3 firmware for 10 GS1900 models on October 23 to fix a separately tracked flaw, CVE-2026-107441, an out-of-bounds write in the web request handler that Patch 2's counter check does not stop.
What's compelling: GreyNoise reported attackers took data from 996 GS1900 switches around August 17, including switch configurations, hashed root credentials and network information, and 564 of those switches still used factory-default credentials. CISA's KEV catalog, which set a September 24 deadline for the Patch 2 fix, does not list CVE-2026-107441, and Zyxel's advisory offers no workaround and does not say whether updating removes access an attacker already has.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-107441CVE-2026-7273
- Related
- Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through Word Press Exploitation Cyber Risks ·CVE-2026-7273: Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability Known Exploited Vulnerabilities · Sep 21, 2026