Zyxel GS1900 network switches that received the vendor's earlier fix for an actively exploited flaw are still open to the exploit attackers used, researchers at Binarly found. The exploit lets anyone who can reach a switch's web management interface run commands on it without logging in. Zyxel has released new firmware for 10 GS1900 models that closes the hole.
Zyxel GS1900 Patch Fails to Block Zero-Day Exploit Allowing Root Command Execution
About this summary. This is a short excerpt from the description that The Hacker News published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://thehackernews.com/2026/11/zyxel-gs1900-patch-fails-to-block-zero.html
Source attribution: headline and facts are from The Hacker News (thehackernews.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Zyxel Switch Hacks Blamed on Patched Flaw Actually Exploited a Zero-Day
Tracked as CVE-2026-107441, the out-of-bounds write flaw could allow attackers to execute OS commands via crafted HTTP requests.
Two Barracuda ESG Flaws Could Be Combined for Full Root Access; Patches Released
Barracuda patched two flaws that can be chained to give attackers root access to Email Security Gateway appliances. Barracuda has patched two vulnerabilities that can be…
Zyxel fixes zero-day exploited to hack nearly 1,000 network switches
Zyxel has patched a zero-day vulnerability in its GS1900 series network switches that hackers exploited to compromise nearly 1,000 devices worldwide and steal…
UEFI bootkit infected fully patched Windows machines. Is Microsoft to blame?
In 2023, malware tracked as BlackLotus became the first publicly documented in-the-wild UEFI bootkit capable of bypassing Secure Boot on fully updated Windows 11…
Pre-Auth RCE in Zyxel GS1900 Exploited in the Wild as a Zero-Day
GreyNoise and CISA KEV linked this Zyxel GS1900 exploit to CVE-2026-7273, but it hits a zero-day. We cover the actor, JITTERLY, SIXZUT, and the exploit.
Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain
CISA has added CVE-2026-111357 and CVE-2026-118527 to its KEV catalog after the Ivanti VPN flaws were chained in zero-day attacks.