Ethical Hacking News
A critical vulnerability has been discovered in the Zyxel GS1900 network switches, allowing attackers to gain root command execution. Network administrators and security experts must take immediate action to protect their networks by updating the firmware and implementing additional security measures.
Zero-day exploit found in Zyxel GS1900 network switches, allowing attackers to gain root command execution.Vulnerability discovered by Binarly researchers, rated as 9.8 out of 10 on CVSS severity scale.Exploit allows attackers to download switch configurations, hashed root credentials, and network information.Attackers have been using exploit to download data-collection script and leave collected data to be picked up.U.S. CISA has added CVE-2026-7273 to its Known Exploited Vulnerabilities (KEV) catalog.Network administrators advised to update firmware on all GS1900 switches to the latest version.Additional security measures such as firewalls and intrusion detection systems recommended.Vulnerability not limited to GS1900 switches, but also affects other devices using the same firmware.
The recent announcement by Zyxel regarding the patch for the GS1900 network switches has sent shockwaves throughout the cybersecurity community. The patch, which was released in response to a zero-day exploit, has been found to be ineffective in blocking the exploit, allowing attackers to gain root command execution. This vulnerability has left many network administrators and security experts scrambling to understand the implications and take necessary measures to protect their networks.
According to Binarly, the researchers who discovered the vulnerability, the exploit allows anyone who can reach a switch's web management interface to run commands on it without logging in. This means that even if an attacker is not able to gain administrative access to the switch, they can still exploit the vulnerability to gain control over the device.
The vulnerability, which is tracked as CVE-2026-7273, was discovered by Binarly's researchers on September 29, 2026. They reported the flaw to Zyxel, which subsequently released the 2.90 Patch 2 firmware to address the issue. However, Binarly's researchers found that the new firmware did not adequately address the vulnerability, and that the 2.90 Patch 3 firmware released on October 23 was still vulnerable to the exploit.
GreyNoise, a security firm that monitors attack traffic through a network of sensors, reported on September 21 that attackers had already been exploiting the vulnerability to download data from 996 GS1900 switches around August 17. The attackers were able to exploit the vulnerability to download switch configurations, hashed root credentials, and network information, and had even managed to crack the factory-default credentials on 564 of the switches.
The researchers at Binarly have rated the vulnerability as 9.8 out of 10 on the CVSS severity scale, indicating that it is highly critical and poses a significant risk to network security. The vendor's advisory for the 2.90 Patch 3 firmware rates the vulnerability as 8.8 on the CVSS severity scale, which is still considered high.
The reason why the earlier fix did not stop the exploit is due to a flaw in the program that handles web requests on the switch. The program stores each request parameter in a fixed area that can accommodate 140 parameters, but it never checks the size of a parameter. When an attacker sends a 140th parameter that is too large, it overflows the end of the area, allowing the attacker to swap the function the program is about to call for one that runs the attacker's command. The 2.90 Patch 2 firmware added a check on the counter, but the check runs only after the oversized parameter has been copied, allowing the attacker to still exploit the vulnerability.
The attackers have been using the exploit to download a data-collection script onto the switches and leave the collected data to be picked up. The data collected includes switch configurations, hashed root credentials, and network information. The attackers are believed to be the same group that Acronis tracks as Red Heron and describes as Chinese-speaking.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-7273 to its Known Exploited Vulnerabilities (KEV) catalog, and has given federal agencies until September 24 to apply the vendor's fix. However, it is unclear whether the new firmware will be enough to prevent the exploitation of the vulnerability.
In light of this vulnerability, network administrators and security experts are advised to take immediate action to protect their networks. This includes updating the firmware on all GS1900 switches to the latest version, as well as implementing additional security measures such as firewalls and intrusion detection systems. It is also recommended that network administrators regularly monitor their networks for signs of exploitation and take prompt action to respond to any security incidents.
Furthermore, it is essential to understand that the vulnerability is not limited to the GS1900 switches, but also affects other devices that use the same firmware. Therefore, network administrators should also consider updating their firmware on other devices that use the same firmware to prevent potential exploitation.
In conclusion, the Zyxel GS1900 patch has failed to block the zero-day exploit, allowing attackers to gain root command execution. Network administrators and security experts must take immediate action to protect their networks by updating the firmware on all GS1900 switches and implementing additional security measures.
A critical vulnerability has been discovered in the Zyxel GS1900 network switches, allowing attackers to gain root command execution. Network administrators and security experts must take immediate action to protect their networks by updating the firmware and implementing additional security measures.
Related Information:
https://www.ethicalhackingnews.com/articles/Zyxel-GS1900-Patch-Fails-to-Block-Zero-Day-Exploit-Allowing-Root-Command-Execution-ehn.shtml
https://thehackernews.com/2026/11/zyxel-gs1900-patch-fails-to-block-zero.html
Published: Thu Nov 5 02:53:45 2026 by llama3.2 3B Q4_K_M
