Severity: Critical | Priority: 1
A critical flaw in the web management interface of Zyxel GS1900 series network switches lets an attacker take full control of the switch with root privileges. It needs no login and no user interaction. The weakness is in the program that handles requests to the switch’s management pages. It copies submitted form fields into a fixed set of 140 slots before checking how many fields have arrived. By sending a specially built request with an oversized final field, an attacker can overwrite the internal counter and then rewrite memory that controls what the switch executes. Ten GS1900 models are affected, including the 8-, 10-, 16-, 24- and 48-port variants and their PoE versions. A firmware update Zyxel released in June 2026 for an earlier flaw in the same code did not fix this problem. The weakness stayed exploitable until Zyxel’s update of 22 October 2026.
The flaw was exploited as a zero-day before it was fixed. Around 17 August 2026, a single attacker compromised close to a thousand GS1900 switches in 48 countries, with the largest numbers in Italy, the United States and Taiwan. From those switches the attacker took the full configuration, the hashed root password and details of the surrounding network. More than half of the affected switches were still using their factory-default passwords. Researchers link this activity to Red Heron, a Chinese-speaking actor that also exploited a critical flaw in self-hosted Gitea code servers. That campaign stole hundreds of source-code repositories, including industrial control software. On compromised Linux systems, Red Heron installs JITTERLY, a backdoor with more than 30 remote-control functions, together with SIXZUT, a rootkit that hides the backdoor and keeps restarting it.
Administrators should update every GS1900 switch to the latest firmware, the .3 release for each model. That includes switches that are not exposed to the internet, since an attacker who gains any foothold inside the network can reach them. No configuration setting closes the flaw. Until switches are updated, place their management interfaces on a dedicated management network that only administrator machines can reach, and turn off remote and internet-facing management. On any switch that may have been exposed, assume its configuration and password hash were stolen: change the administrator password and replace SNMP community strings and any RADIUS, TACACS+ or VPN secrets stored on it. Replace factory-default passwords on all network devices. On servers that contacted the actor’s infrastructure, check /etc/ld.so.preload for unexpected entries, look for hidden folders named __hesti or __root under /usr/lib, and rebuild any affected system from a known-good image.