The flaw exists because input validation logic in the Patch 2 firmware occurs only after the memory corruption has already triggered, allowing an attacker to overwrite internal control variables and redirect execution flow to attacker-supplied commands. Zyxel has released Patch 3 firmware to remediate this issue.

Attack Chain

1. Attacker identifies internet-exposed GS1900 switch management interface.
2. Attacker sends a crafted HTTP request with an oversized 140th parameter to the web management service.
3. The service performs an out-of-bounds write, overwriting the parameter counter and subsequent memory.
4. The attacker achieves arbitrary code execution with root privileges.
5. The attacker downloads and executes a data-collection script.
6. The script harvests configuration data and hashed root credentials from the device.
7. Data is staged for exfiltration via the web interface.

Impact

Successful exploitation allows unauthenticated attackers to gain root-level access to the switch. Observed impact includes the exfiltration of device configurations and hashed root credentials. Attackers have been observed targeting these devices to perform mass data collection, with a high proportion of affected devices identified as still running factory-default credentials.

Recommendation

1. Immediately apply the 2.90 Patch 3 firmware update to all Zyxel GS1900 models listed in the advisory.
2. Inventory all internet-exposed network management interfaces and restrict access to these services to trusted management subnets via firewall rules.
3. Audit all GS1900 switches for evidence of unauthorized persistent scripts or modified configuration files.
4. Rotate all credentials on any GS1900 switches that were reachable via the internet prior to patching, particularly those where default credentials remained in use.