Covered by 2 outlets — first reported by The Hacker News, Nov 5, 07:06 UTC
Zyxel GS1900 Patch Fails to Block Zero-Day Exploit Allowing Root Command Execution
MentionsZyxel
Summary
Zyxel GS1900 network switches that received an earlier fix for an exploited flaw remain open to the exploit attackers used, according to researchers at Binarly. The earlier patch addressed a different bug, CVE-2026-7273, while the exploit relies on CVE-2026-107441, which lets someone who can reach a switch's web management interface run commands without logging in. Zyxel has released new firmware for 10 GS1900 models that closes the hole.
AI summary by the SecurityTabs newsroom, checked against The Hacker News, Help Net Security. Read the outlets below for the full story.
Continue reading
2 outlets, in the order they reported it.
The Hacker NewsFirst report
Zyxel GS1900 Patch Fails to Block Zero-Day Exploit Allowing Root Command Execution
Zyxel GS1900 network switches that received the vendor's earlier fix for an actively exploited flaw are still open to the exploit attackers used, researchers at Binarly found.
Help Net Security
Patched Zyxel GS1900 switches remained open to in-the-wild exploit (CVE-2026-107441)
Zyxel GS1900 series network switches that received a fix for a flaw that was later reported to have been exploited in the wild are still open to an exploit attackers used, Binarly found.
Explained
The technology and terms in this story. Learn more
- ConceptZero-dayA flaw attackers exploit before the vendor has a fix: defenders have had zero days to patch.
- WeaknessMemory corruptionBugs that let a program write where it shouldn't in memory, often leading to code execution.
- ConceptExploitCode or a technique that turns a software flaw into something an attacker can actually use.
- ConceptCVE · Common Vulnerabilities and ExposuresThe public ID system for vulnerabilities, such as CVE-2026-12345, so everyone means the same bug.
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.