Exploited Zyxel Switch Vulnerability Added to CISA KEV

TL;DR

On September 21, 2026, federal authorities confirmed active attacks against a critical Zyxel switch vulnerability. The flaw allows unauthenticated local attackers to execute arbitrary system commands on affected hardware. Organizations must update vulnerable switches immediately to prevent complete network compromise.

Why It Matters

Federal agencies must secure their infrastructure against active network intrusions. According to a CISA alert, evidence confirms attackers are exploiting this security defect in the wild. Industry telemetry estimates that thousands of small and medium enterprises rely on these switches daily. Consequently, a breach at the switch level grants attackers unrestricted visibility across internal local networks. While authorities confirmed live attacks, researchers have not confirmed any public proof-of-concept exploit code. Federal civilian agencies have until September 24, 2026, to apply vendor fixes.

How The Attack Works

The issue stems from a stack-based buffer overflow within the device web management interface. In a formal security bulletin, the Zyxel security advisory explains that the flaw resides inside the CGI program. Attackers send a specially crafted HTTP request across the local network to trigger the memory corruption. The software fails to validate boundary lengths before copying data to the stack buffer. As a result, the input overwrites adjacent memory spaces in the device runtime. This flaw allows an unauthenticated adversary to run unauthorized operating system commands with elevated privileges.

Affected Versions

The vulnerability impacts multiple models within the GS1900 product family running firmware version 2.90 and earlier. Impacted switches include the GS1900-8, GS1900-8HP, GS1900-10HP, and GS1900-16. Larger deployments using GS1900-24, GS1900-24HPv2, GS1900-48, and GS1900-48HPv2 are also vulnerable. Other Zyxel switch series remain unaffected by this defect.

Patch Or Mitigation Steps

Network administrators must install the latest firmware releases provided by Zyxel. Upgrading device firmware resolves the stack buffer overflow completely. Administrators should also isolate administrative interfaces from untrusted LAN segments. In addition, restrict switch management access to dedicated virtual LANs or trusted IP addresses. Promptly patching this exploited Zyxel switch vulnerability prevents attackers from gaining persistent footholds inside internal networks.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.