VulnHub

Real-time Cybersecurity News

Critical

Zyxel GS1900 Patch Fails to Block Zero-Day Exploit Allowing Root Command Execution

The Hacker News
Actively Exploited
Zero-dayExploitVulnerabilityPatch

Overview

Researchers from Binarly have discovered that Zyxel GS1900 network switches are still vulnerable to a zero-day exploit, even after the company released a patch intended to fix the issue. This exploit allows attackers to execute commands on the switches through the web management interface without needing to log in. Zyxel has since issued new firmware updates for ten models in the GS1900 series to address this vulnerability. The earlier fix, version 2.90, did not completely close the security gap, which raises concerns about the effectiveness of their initial response. Organizations using these switches need to apply the latest firmware updates to protect against potential unauthorized access.

Key Takeaways

  • Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
  • Affected Systems: Zyxel GS1900 series network switches, specifically the models receiving firmware updates.
  • Action Required: Zyxel has released new firmware for 10 GS1900 models that addresses the vulnerability.
  • Timeline: Ongoing since discovery of the exploit.

Original Article Summary

Zyxel GS1900 network switches that received the vendor's earlier fix for an actively exploited flaw are still open to the exploit attackers used, researchers at Binarly found. The exploit lets anyone who can reach a switch's web management interface run commands on it without logging in. Zyxel has released new firmware for 10 GS1900 models that closes the hole. The earlier fix is the 2.90

Impact

Zyxel GS1900 series network switches, specifically the models receiving firmware updates.

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Ongoing since discovery of the exploit.

Remediation

Zyxel has released new firmware for 10 GS1900 models that addresses the vulnerability. Users are advised to update to the latest firmware version beyond 2.90.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Zero-day, Exploit, Vulnerability, and 1 more.

Read Original Article

Related Coverage

ThreatsDay: Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijacks + 17 More Stories

The Hacker News

Recent reports indicate significant security incidents affecting various platforms, including Apache OFBiz, which has a remote code execution vulnerability. Attackers can exploit this flaw to gain unauthorized access to systems, potentially leading to data theft or disruption. Additionally, a breach at DreamHost has compromised user accounts, raising concerns about the safety of personal information. In another alarming development, decentralized finance (DeFi) sites have been hijacked, which could result in substantial financial losses for users. These incidents emphasize the ongoing challenges in cybersecurity, as many systems remain unpatched for extended periods, making them vulnerable to exploitation.

Nov 5, 2026

Is Your Exposure Management Platform Leaving You Exposed? Five Tests to Find Out

The Hacker News

The article discusses the potential risks associated with exposure management platforms in cybersecurity. It points out that a critical finding can pass through various security tools yet still leave organizations vulnerable. Key details, such as system ownership, accessibility to attackers, existing protections, and the business impact of changes, can be missing from the findings. Each absent piece of information increases the risk of exposure, suggesting that organizations need to ensure comprehensive tracking and management of vulnerabilities. This is particularly important as a lack of clarity can lead to significant security gaps.

Nov 5, 2026

Apple to Start Scanning Publicly Shared iCloud Photos and Files for Harmful Content

The Hacker News

Apple has announced that it will begin scanning publicly shared iCloud links for harmful content, a move set to roll out with the upcoming updates to iOS 27.3, iPadOS 27.3, macOS 27.3, and visionOS 27.3. This change specifically targets files and photos shared via iCloud that are accessible to anyone with the link. The intention behind this initiative is to enhance user safety by identifying and potentially removing harmful material before it can be accessed by others. This update reflects growing concerns about online content safety and the role tech companies play in moderating shared materials. Users who share iCloud links should be aware that their content will be subject to this new scanning process, which could influence how they choose to share files in the future.

Nov 5, 2026

CERT-In Flags AI-Driven Attacks as Backdoored ARTEX Exposes 62 Consoles to Root Access

The Hacker News

The Indian Computer Emergency Response Team (CERT-In) has reported that a threat actor known as Crafty Falcon is using AI-assisted tools to target organizations in India's Banking, Financial Services, and Insurance (BFSI) sectors. This ongoing attack involves exploiting vulnerabilities in a backdoored version of a tool called ARTEX, which has exposed 62 consoles to root access. The use of publicly available AI-driven security tools indicates that attackers are becoming increasingly sophisticated and resourceful. This situation raises significant concerns for the affected sectors, as unauthorized root access could lead to severe data breaches and operational disruption. Organizations in these industries need to be vigilant and enhance their security measures to defend against such threats.

Nov 5, 2026

Hackers Exploit Patched Apple Flaw to Deliver Info-Stealing Malware, CISA Says

The Hacker News

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has flagged a medium-severity vulnerability in several Apple operating systems, identified as CVE-2024-27834. This flaw stems from improper authentication, which could enable an attacker to execute malicious actions on affected devices. Reports indicate that this vulnerability is currently being exploited in the wild, making it a pressing concern for users of Apple's software. The affected systems include various versions of macOS, iOS, and iPadOS. Users are advised to ensure their devices are updated to mitigate the risk of falling victim to information-stealing malware associated with this exploit.

Nov 5, 2026

OpenAI AI Pipeline Generates 948 Linux Root Escalation Exploits in 30-Hour Run

The Hacker News

OpenAI recently announced a successful run of an AI pipeline that identified and patched 948 local privilege escalation vulnerabilities in the Linux operating system. Over a 30-hour period, the AI model analyzed 2,308 potential vulnerabilities, reproducing 1,724 of them in the process. The project, which cost $1.2 million in API usage, demonstrates the capability of AI to assist in cybersecurity by automating the detection and remediation of significant security flaws. This is particularly important as local privilege escalation vulnerabilities can allow attackers to gain elevated access to systems, potentially leading to more severe breaches. The findings underscore the growing role AI can play in enhancing cybersecurity defenses.

Nov 5, 2026