Your Patched Zyxel Switch May Still Be Vulnerable

A security patch for popular Zyxel network switches failed, leaving them open to a critical flaw that allows full remote takeover.

Zyxel has released a new emergency firmware update for its popular GS1900 series network switches after a previous patch failed to fix a critical vulnerability. According to research from security firm Binarly, reported by The Hacker News, the initial fix left the devices exposed to the original exploit. This flaw allows an unauthenticated attacker to execute commands with the highest-level (root) privileges simply by accessing the switch's web management interface. The vulnerability is being actively exploited, making the new patch a critical priority for any organization using the ten affected GS1900 models. The failed patch, firmware version 2.90, created a false sense of security for IT teams who believed they had already mitigated the risk.

The vulnerability is a form of unauthenticated remote code execution (RCE). In simple terms, an attacker who can reach the switch’s web login page can send a specially crafted request that bypasses the need for a username or password. This request tricks the device’s software into running commands directly on the underlying operating system. The initial patch likely addressed one specific method of command injection but failed to cover all possible attack vectors, a common issue known as an incomplete fix or a patch bypass. Attackers often analyze security patches to understand the vulnerability they fix, and an incomplete patch can inadvertently guide them to alternative ways of exploiting the same core weakness. This allows them to re-exploit patched systems with a slightly modified attack.

This incident highlights a persistent and dangerous trend in infrastructure security: vulnerabilities in the foundational hardware that underpins corporate networks. Devices like switches, routers, and firewalls are high-value targets because they control the flow of all network traffic. A compromised switch can be used to intercept sensitive data, pivot to attack other systems on the network, or disrupt operations entirely. The failure of the first patch also underscores a broader industry challenge. Releasing a flawed fix is sometimes worse than releasing no fix at all, as it erodes trust and leaves diligent administrators unknowingly exposed. It serves as a reminder that patching is not a one-time event but a continuous process of verification and vigilance.

For IT and security teams, the immediate takeaway is to treat this as a new, urgent threat. Any Zyxel GS1900 switch that was updated to firmware 2.90 is not secure and must be patched again with the latest release. This event also reinforces the importance of network security best practices, such as ensuring that device management interfaces are never exposed to the public internet and are only accessible from trusted, internal administrative networks. Organizations should review their asset management systems to ensure they can quickly identify all vulnerable hardware. Moving forward, teams must remain skeptical and verify that patches have truly resolved the underlying issue, rather than simply assuming a vendor's fix is complete.

This vulnerability allows unauthenticated remote code execution with root privileges on widely used network hardware. The failed patch means teams who thought they were secure are still exposed to active exploits, making immediate patching of the new firmware a critical priority for network administrators.

Compromised network switches can lead to full network breaches, data theft, and significant operational downtime. The false sense of security from the failed patch increases this risk, potentially leading to costly incident response and reputational damage if not addressed by applying the latest firmware.