{
  "id": 18275901,
  "title": "Zyxel GS1900 Patch Fails to Block Zero-Day Exploit Allowing Root Command Execution",
  "url": "https://urgent.news/2026/11/05/zyxel-gs1900-patch-fails-to-block-zero-day-exploit-allowing-root",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-05T07:06:33.000Z",
  "source": {
    "name": "The Hacker News",
    "slug": "the-hacker-news",
    "url": "https://thehackernews.com/2026/11/zyxel-gs1900-patch-fails-to-block-zero.html"
  },
  "original_language": "en",
  "account": "Zyxel GS1900 switches that had received earlier security patches remain vulnerable to a zero-day exploit, researchers discovered. The vulnerability enables an attacker to execute commands on the switch's web management interface without authentication. Zyxel has issued updated firmware for ten models of the GS1900 switches to address the flaw, identified as CVE-2026-107441. The earlier patch, Patch 2, is not sufficient to prevent the exploit. The researchers reported the flaw to Zyxel on September 29, and the vendor released Patch 3 on October 23. Researchers say the vulnerability lies in an out-of-bounds write issue within the program handling web requests on the switch. By exploiting this flaw, an attacker can overwrite memory and inject their own commands that run with root privileges. The exploit was already in use by attackers who accessed 996 GS1900 switches around August 17, according to GreyNoise monitoring data. The affected switches were not using the earlier Patch 2 firmware. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) listed CVE-2026-7273 as a known exploited vulnerability on September 21, urging federal agencies to apply the patch by September 24.",
  "summary": "Zyxel GS1900 network switches that received the vendor's earlier fix for an actively exploited flaw are still open to the exploit attackers used, researchers at Binarly found. The exploit lets anyone who can reach a switch's web management interface run commands on it without logging in. Zyxel has released new firmware for 10 GS1900 models that closes the hole. The earlier fix is the 2.90",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}