Zyxel GS1900 fix doesn't stop the exploit attackers used, researchers say

Zyxel GS1900 switches that took the vendor's earlier fix for an actively exploited flaw are still open to the exploit attackers used, according to researchers at Binarly. The report is dated Nov 05, 2026.

The exploit lets anyone who can reach a switch's web management interface run commands on it without logging in. That's the whole of the technical detail in the write-up we have; nobody has published a fuller analysis of why the earlier patch missed.

Zyxel has put out new firmware for 10 GS1900 models that closes the hole. The earlier fix is the 2.90 release, per the report.

If you run GS1900s, the first thing to check is whether the web management interface is reachable from anywhere it doesn't need to be. That's the precondition for the attack, and it's the part you control while you schedule the firmware. Then confirm which of the 10 covered models you have and move them to the new build rather than assuming the 2.90 update settled it.

We'd treat a patch that didn't hold as a reason to check the switches directly, not just the version string. The report doesn't say how many devices were hit, who was targeted, or whether the new firmware has been tested against the same exploit.