Zyxel GS1900 Patch Fails to Block Zero-Day Exploit Allowing Root Command Execution

Researchers at Binarly discovered that Zyxel GS1900 network switches remain vulnerable to remote code execution despite receiving an earlier firmware update for CVE-2026-7273. The underlying flaw, tracked as CVE-2026-107441, stems from an out-of-bounds memory write in the web management request parsing function when handling oversized parameters. Unauthenticated attackers with network reachability to the web administration interface can leverage this zero-day to execute arbitrary commands with root privileges.

Source: The Hacker News

How Mangudai Discovers This Issue

Mangudai's port module identifies exposed Zyxel switch web management interfaces reachable from the internet. It alerts on publicly exposed administrative portals and matches advertised software version banners against known vulnerable firmware versions such as Patch 2 for CVE-2026-107441.

Continuous Autonomous AuditsMangudai scans target perimeters multiple times daily to catch configuration drift instantly.

Zero-Agent ArchitectureIdentifies exposure angles without requiring local installations or server access.

Check what your own domain exposes

A free scan lists the services, software versions, certificates and headers your domain shows to the internet, so you can see whether a flaw like this could apply to you. It reads what is visible from the outside; it does not confirm that a specific vulnerability can be exploited.

Launch Scan For My Domain