# Binarly finds Zyxel switch exploit still works after earlier patch

_Published Friday, November 6, 2026 at 8:20 PM EST · Security · Latest · Tier 2 — Notable_

![Binarly finds Zyxel switch exploit still works after earlier patch — Primary](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhaF7lULSp8hpZx_WSDcDsJxD9TzTOH5Oo5dkFteUVQqQMOXc7ZyytOxbNgL01vkV43Kx0V0sDzJvKGrZvPwjos_-g9djk8jVAqSN04CIhGoiWWUMLdyKQH32ES8ghi-6ilZbnbGi_WIRi8hvzik6ztrin-MZEK1QI2CKR3Lk1sUg3yVYuhGvsX0pC85Qg/s1700-nu-rw-lo-l85-e365/zyxel-hacker.jpg)

Zyxel GS1900 switches running the vendor's earlier security fix remain vulnerable to the exploit used by attackers, Binarly researchers found, The Hacker News reported. Anyone able to reach a vulnerable switch's web management interface can execute commands without logging in, with root privileges.

Binarly says Patch 2 checks a parameter counter only after an oversized request parameter has overwritten it. Patch 3 checks the counter before copying and limits the copy's size. Zyxel posted that firmware for 10 models on October 23.

GreyNoise reported data theft from 996 switches around August 17, but neither GreyNoise nor Binarly establishes that those attacked devices were running Patch 2.

## Sources

- [The Hacker News](https://thehackernews.com/2026/11/zyxel-gs1900-patch-fails-to-block-zero.html)

---
Canonical: https://techandbusiness.org/newswire/6oNJJ3OpI1X6pcEmdUbwLT
Published: 2026-11-07T01:20:35.337Z
Story chronology: 2026-11-05T07:06:00.000Z
Retrieved: 2026-11-08T06:09:16.185Z
Publisher: Tech & Business (techandbusiness.org)