Binarly finds Zyxel switch exploit still works after earlier patch

Zyxel GS1900 switches running the vendor's earlier security fix remain vulnerable to the exploit used by attackers, Binarly researchers found, The Hacker News reported. Anyone able to reach a vulnerable switch's web management interface can execute commands without logging in, with root privileges. Binarly says Patch 2 checks a parameter counter only after an oversized request parameter has overwritten it. Patch 3 checks the counter before copying and limits the copy's size. Zyxel posted that firmware for 10 models on October 23. GreyNoise reported data theft from 996 switches around August 17, but neither GreyNoise nor Binarly establishes that those attacked devices were running Patch 2.