Zyxel Patch Leaves GS1900 Switches Exposed to Ongoing Zero‑Day Attack

Security researchers at Binarly have discovered that a recent firmware update intended to close a critical flaw in Zyxel's GS1900 series of network switches does not actually prevent exploitation of the vulnerability. The oversight leaves devices that have applied the vendor's patch still susceptible to a zero‑day attack that grants attackers the ability to execute arbitrary commands through the switch's web management interface.

The flaw, first reported as actively exploited in the wild, enables anyone with network access to the switch's HTTP/HTTPS management console to inject malicious code and gain root-level control. Once compromised, a malicious actor can manipulate traffic, intercept data, or use the switch as a foothold for broader network intrusion.

Zyxel initially issued a firmware fix after the vulnerability began attracting attention from security analysts and threat actors. The patch was marketed as a definitive solution, prompting many organizations to deploy the update across their infrastructure. However, Binarly's latest analysis indicates that the patch does not address the underlying code path that the exploit leverages, meaning the attack vector remains open.

In a series of controlled tests, the Binarly team demonstrated that the exploit continues to work against devices running the patched firmware. The researchers traced the issue to a residual authentication bypass in the web interface module, which the original fix failed to remediate. Their findings suggest that the vulnerability is still exploitable without requiring additional privileges or complex payloads.

The persistence of this weakness raises concerns for enterprises that rely on GS1900 switches for campus and data‑center networking. Because switches operate at the core of network traffic, a compromised device can facilitate stealthy data exfiltration, man‑in‑the‑middle attacks, or serve as a launchpad for lateral movement across segmented environments. Security teams are urged to reassess the risk posed by the current firmware version and consider additional mitigations such as network segmentation, restricting management‑plane access, and employing intrusion‑detection systems.

Zyxel has not yet released a follow‑up patch that fully resolves the issue. The company’s security advisory advises customers to monitor for updates and to implement temporary hardening measures, including disabling unnecessary web management services and enforcing strong authentication. Analysts expect that Zyxel will prioritize a comprehensive fix given the active exploitation and the potential impact on critical network infrastructure.