Zyxel GS1900 Switches Face Active Zero-Day Exploitation, Firmware Fix Released

Key points

• Attackers are exploiting a zero-day in Zyxel GS1900 switches.
• The web management interface allows unauthenticated commands to run as root.
• Ten switch models are affected, and the vendor has issued new firmware.
• The update also addresses a patch bypass; no CVE identifier was assigned.

Zyxel has pushed fresh firmware for its GS1900 line after Binarly tied a zero-day flaw to active attacks. The weakness sits in the switches' browser-based administration page and lets an intruder issue commands without logging in, with those commands running at the highest privilege level. Because no CVE number has been published, defenders cannot rely on standard vulnerability feeds to track it.

Ten models in the GS1900 family are in scope, according to the available information. The problem is especially serious for switches exposed to untrusted networks or reachable from the internet, since exploitation requires no credentials. Attackers are already using the flaw, and the vendor's release is meant to close both the original bug and a bypass that could have undone an earlier patch.

Network gear often sits at the edge of a school district's infrastructure, carrying management traffic and separating segments. A compromised switch can give an adversary a quiet foothold, disrupt connectivity, or serve as a pivot toward other systems. For K-12 environments, that risk is amplified by flat networks, limited security staffing, and devices that are installed once and rarely revisited.

Administrators should treat this as a priority patching event rather than a routine update. Inventory every GS1900 device, confirm which units run firmware 2.90, and apply the newest release from Zyxel. Restrict the web management interface to trusted administrative networks, disable remote access where it is not essential, and review logs for unexpected commands or login-free activity.

Watch for further details from Binarly and Zyxel, including any eventual CVE assignment and a clearer list of affected model numbers. Until then, assume exposed switches may have been touched and validate configurations, credentials, and outbound connections from management interfaces.

What to do now

1. Inventory all Zyxel GS1900 switches and identify units running firmware 2.90 and any builds covered by the vendor's new release.
2. Apply the latest Zyxel firmware release to every affected switch, starting with internet-facing or untrusted-network devices.
3. Block public access to the web management interface; allow only trusted admin VLANs or jump hosts.
4. Disable remote management and unused services on GS1900 devices where operationally possible.
5. Rotate administrative credentials and review switch configurations for unauthorized changes after patching.
6. Inspect logs and network telemetry for unauthenticated access attempts or unexpected root-level commands.
7. Monitor Binarly and Zyxel advisories for CVE assignment and updated model coverage.

Original source

The Hacker News