Zyxel GS1900: the previous patch does not close the real flaw

A patch that was not enough

The story coming to us from The Hacker News is an uncomfortable reminder: not every patch closes the door it claims to close. According to Binarly researchers, Zyxel GS1900 switches that had already received the manufacturer's previous fix — firmware version 2.90 — remain vulnerable to the same exploit that is being actively used against these devices. In other words, the update that many administrators installed thinking they were safe does not block the real attack vector.

The flaw allows anyone who can reach the switch's web management interface to execute commands on the device without needing to authenticate. No valid user, no password, no token is required: it is enough to have network access to that interface. And the result is command execution with root privileges, that is, full control of the device. Zyxel has released new firmware for ten models in the GS1900 family that does close the gap.

Why this matters in an SME

At first glance, a switch is a boring network component: it is there, does its job and nobody looks at it. But precisely for that reason it becomes an interesting target. A compromised access switch allows the attacker to see traffic, manipulate VLANs, redirect communications or use the device as a foothold inside the internal network. It is not the billing server, but it is the road along which data travels to that server.

The detail of firmware 2.90 is what should worry us most as an IT team. When a manufacturer releases a fix, the natural tendency is to mark it as resolved in the inventory and move on to the next ticket. This case shows that blind trust is a risk. A patch can mitigate part of the problem and leave the main door open. If the exploit is also already in active use, the margin for error is reduced to zero.

What we recommend doing now

The first thing is to identify whether your organization has Zyxel GS1900 switches and what firmware version they are on. It is not enough to know that "they were updated at the time": you must check the exact version and compare it with the list of ten models that Zyxel has fixed with the new firmware. If the device is among them, the update is not optional.

• Real inventory, not from memory: check the model and firmware version of each switch, including those in secondary cabinets or remote offices.
• Update to the new firmware: 2.90 is not enough according to Binarly. Apply the version now published by Zyxel and verify that the device boots with it.
• Limit access to the web interface: if switch management does not need to be exposed to the entire network, restrict access to a management VLAN and to the IT team's IPs.
• Check for signs of compromise: unexplained configuration changes, new rules, created accounts or anomalous traffic from the switch to the internal network.
• Do not consider a patch closed without verification: when a manufacturer publishes a critical fix, check whether there are independent analyses confirming that it covers the real vector.

A lesson that goes beyond Zyxel

This episode fits with an idea we repeat on the blog: security is not a state reached by installing an update, but a process that requires verification. In our analysis on security looking ahead to 2027 we already insisted that trust must be based on context and verification, not on the password or the "patched" label. This case is a practical example of that idea.

For an SME, the potential impact is not only technical. A compromised access switch can become the path to reach the systems where customer data, billing or email are stored. And in many cases, the attacker does not need anything sophisticated: it is enough to reach a web interface that should have been segmented. As we mentioned in the October cyberthreat review, network equipment and edge devices remain a recurring weak point in SMEs.

The role of the IT team and the provider

If your company does not have a dedicated IT department, this type of advisory is exactly the reason why it is worth having a technology partner that keeps the inventory up to date and reviews the manufacturer's notes. It is not about installing firmware blindly every time a new version appears, but about knowing what devices you have, which fixes are critical and which have been questioned by independent researchers.

The final recommendation is simple: treat patch management as a process with verification, not as a box to be checked. And if you have Zyxel GS1900 switches, check the firmware version and the scope of the web interface today. The exploit is active and the previous patch was not the solution.

Source: The Hacker News. Analysis and adaptation: ForgeNEX.