Zyxel has released updated firmware for 10 GS1900 switch models after security researchers reported that an earlier patch did not fully block an actively exploited attack path. According to the report, an attacker who can reach the device's web management interface could execute commands as root without authentication.

For businesses, the issue is a reminder that network infrastructure devices such as switches, routers and firewalls can become high-impact entry points if management interfaces are exposed or insufficiently protected. The immediate concern is not only patching, but also checking whether device administration is accessible from untrusted networks.

What happened

Researchers at Binarly said Zyxel GS1900 switches that had received the vendor's earlier fix were still vulnerable to the exploit method used by attackers. The reported weakness affects the device web management interface and could allow unauthenticated command execution with root privileges.

Zyxel has now released new firmware for 10 GS1900 models intended to close the gap left by the previous fix. Based on the source information, the earlier remediation in firmware version 2.90 did not fully prevent exploitation.

The source describes the flaw as actively exploited. That makes this more than a routine maintenance update: businesses using affected hardware should treat it as a priority security issue.

Why it matters for European businesses

Managed switches are often overlooked compared with endpoints, servers and cloud services, but they sit at the core of office, warehouse, retail and branch connectivity. If an attacker gains control of a switch, the device could potentially be used to disrupt operations, alter traffic paths, maintain persistence inside a network, or support wider compromise of connected systems.

For SMEs in particular, older or lower-cost network devices may remain in service for years and may not be covered by formal vulnerability management processes. That creates a practical risk: infrastructure devices can stay exposed long after vendor advisories are published.

This also matters from a governance perspective. Companies subject to customer security requirements, cyber insurance conditions, or sector-specific controls may need to show that critical infrastructure devices are patched and that administrative interfaces are restricted.

Who may be affected

The most directly affected organisations are those using Zyxel GS1900 switches, especially where the web management interface is reachable beyond a tightly controlled internal admin network.

• SMEs and offices using Zyxel switching equipment for day-to-day connectivity
• Retail and e-commerce operations with stores, warehouses or branch sites that rely on remotely managed network hardware
• IT teams and managed service providers responsible for patching and monitoring distributed network equipment
• Multi-site businesses where legacy device configurations may have left management interfaces exposed

Risk may be higher in environments where network devices are internet-accessible, where remote administration is enabled without strict access controls, or where firmware updates are applied irregularly.

What companies should consider

• Identify affected devices and verify whether any Zyxel GS1900 models are deployed across headquarters, branches, retail sites or warehouses.
• Apply the latest Zyxel firmware released for the relevant model rather than assuming the earlier patch fully mitigated the issue.
• Restrict access to web management interfaces so they are available only from trusted internal networks or secure administrative channels.
• Review internet exposure of switches, routers and other infrastructure devices, including temporary access rules that may have been left in place.
• Check logs and device behaviour for signs of unexpected administrative activity or configuration changes, where logging is available.
• Include network hardware in vulnerability management alongside servers, endpoints and SaaS systems, especially in smaller organisations where these assets are often missed.

Where businesses depend on external IT providers, this is also a good time to confirm who is responsible for monitoring vendor advisories, applying firmware updates and validating that fixes actually close known attack paths.