Zyxel GS1900 Patch Fails to Block Zero-Day Exploit Allowing Root Command Execution

Researchers at Binarly discovered that Zyxel's earlier firmware patch (Patch 2) for GS1900 switches failed to fully mitigate a critical zero-day vulnerability, CVE-2026-107441, which allows unauthenticated attackers to execute root-level commands via a web interface memory corruption flaw. The vulnerability stems from an out-of-bounds write due to missing input size and count validation, enabling exploitation even after Patch 2 was applied. A new firmware update (Patch 3) has been released to properly address the issue. GreyNoise observed active exploitation of related infrastructure, with attackers exfiltrating switch configurations and credentials, linked to a Chinese-speaking group tracked as Red Heron.

AI-extracted · verify before operational use