HighZero-Day
Zyxel GS1900 Patch Fails to Block Zero-Day Exploit Allowing Root Command Execution
The Hacker News·Source published ·1 min read·Video available
Advisory videoOpen on YouTube ↗
What happened?
Zyxel GS1900 network switches that received the vendor's earlier fix for an actively exploited flaw are still open to the exploit attackers used, researchers at Binarly found. The exploit lets anyone who can reach a switch's web management interface run commands on it without logging in. Zyxel has released new firmware for 10 GS1900 models that closes the hole.
Key details
- The new vulnerability is tracked as CVE-2026-107441 and was fixed in 2.90 Patch 3 firmware released on October 23.
- Attackers exploited 996 GS1900 switches around August 17, stealing configurations, hashed root credentials, and network data.
- The exploit works by sending an oversized 140th parameter that overwrites a function pointer after Patch 2's counter check runs too late.
- Researchers rate the flaw 9.8 CVSS; vendor rates it 8.8, and commands execute with root privileges.
Affected
- GS1900-8 firmware 2.90(AAHH.2)C0 and earlier
- GS1900-8HP firmware 2.90(AAHI.2)C0 and earlier
- GS1900-10HP firmware 2.90(AAZI.2)C0 and earlier
- GS1900-16 firmware 2.90(AAHJ.2)C0 and earlier
- GS1900-24 firmware 2.90(AAHL.2)C0 and earlier
- GS1900-24E firmware 2.90(AAHK.2)C0 and earlier
What to look for
- Exploit found in an open folder on a server acting as a JITTERLY command server.
Summarised by SecOraLens from The Hacker News. Always read the original source before acting. How SecOraLens verifies advisories.