Zyxel GS1900 firmware update released after patch fails to block exploit

Zyxel has released updated firmware for 10 models of its GS1900 network switches following the discovery that a previous security patch failed to address a critical vulnerability. Security researchers at Binarly identified that the exploit, which allows for unauthorized root command execution, remained active even after the deployment of the 2.90 version.

• The vulnerability affects 10 distinct Zyxel GS1900 switch models.
• Attackers can run root-level commands without requiring any credentials.
• The flaw is triggered via the switch's web management interface.
• A new firmware release has been issued to permanently close the security gap.

The Vulnerability Explained The critical flaw allows anyone who can reach the web management interface of a Zyxel GS1900 switch to execute commands as a root user. Because no authentication is required to trigger the exploit, it poses a major threat to any organization relying on these devices for network infrastructure, potentially allowing unauthorized access to the entire local network.

Failure of the Initial Patch The previous attempt to fix this issue, included in firmware version 2.90, proved ineffective. Researchers discovered that attackers could still leverage the same exploit chain despite the update. Zyxel responded by issuing a revised firmware version specifically designed to fully neutralize the root command execution vulnerability.

Security Recommendations For IT professionals and network administrators, immediate action is required to patch all affected GS1900 devices. Beyond updating the firmware, it is recommended to restrict access to the web management interface to trusted administrative IP addresses only, ensuring the interface is not exposed to the public internet.