Zyxel Switch Hacks Blamed on Patched Flaw Actually Exploited a Zero-Day
Teaser from the source
Tracked as CVE-2026-107441, the out-of-bounds write flaw could allow attackers to execute OS commands via crafted HTTP requests. The post Zyxel Switch Hacks Blamed on Patched Flaw Actually Exploited a Zero-Day appeared first on SecurityWeek .
This is the RSS-feed teaser. Read the full article at the original source.
Read at SecurityWeekLinked advisories
- CVE-2026-107441Zyxel GS1900-24E firmware: Schreiben außerhalb des zugewiesenen Speichers (Out-of-bounds Write)
- CVE-2026-107441Zyxel GS1900 switches: zero-day CVE-2026-107441 exploited on ~1,000 switches, the CVE-2026-7273 fix didn't stop it
- CVE-2026-107441Zyxel GS1900-24E firmware: Schreiben außerhalb des zugewiesenen Speichers (Out-of-bounds Write)
- CVE-2026-107441Zyxel Switch: Schwachstelle ermöglicht Codeausführung
Affected vendors and products
More on Actually
Other advisories
- Not ratedosv:CLEANSTART-2024-JO21866When resolving a symlink, a race may occur where the buffer passed to `readlink` may actually be smaller than necessary
- Not ratedosv:CVE-2026-99119drm/amdgpu/userq: actually validate userq BOs
- LowCVE-2026-89628HID: picolcd: clamp eeprom debugfs read to bytes actually received
- Not ratedosv:CVE-2026-89628HID: picolcd: clamp eeprom debugfs read to bytes actually received
- MediumCVE-2023-45872An issue was discovered in Qt before 6.2.11 and 6.3.x through 6.6.x before 6.6.1. When a QML image refers to an image whose content is not known yet, there is an assumption that it is an SVG document, leading to a denial of service (application crash) if it is not actually an SVG document.
- Not ratedosv:ECHO-2327-9760-e268Claimed out-of-bounds write in dlx_rtype_to_howto() (bfd/elf32-dlx.c), reached from elf32_dlx_info_to_howto_rel() via the relocation type of a crafted ELF/DLX object. The DLX backend is not built. dlx_elf32_be_vec is selected only by the dlx-*-elf target triple (bfd/config.bfd), and that vec is the sole trigger for compiling elf32-dlx.lo (bfd/configure.ac); debian/rules passes an explicit per-architecture --enable-targets list and never --enable-targets=all. Verified against the shipped amd64 and arm64 debs: libbfd exports no dlx symbols, `objdump -b elf32-dlx` returns "invalid bfd target", `ld -m elf32dlx` is an unrecognised emulation, and a crafted EM_DLX (0x5aa5) object carrying relocation types past the end of the howto table is claimed by the generic elf32-big backend, which reports "architecture: UNKNOWN!" and every relocation as UNKNOWN. The function is never entered. Note that readelf prints DLX machine and relocation names from its own tables, independent of BFD, so its output is not evidence of the backend being present. Upstream also rejects the finding on its merits, even with DLX enabled. On the Red Hat bug that Debian's tracker carries as its only reference, maintainer Andrew Burgess concludes "I don't believe that this is actually a bug": DLX relocation types are a contiguous 0-9, not the non-contiguous space with extended types at 0x10000+ that the advisory describes; dlx_rtype_to_howto() already rejects r_type >= R_DLX_max (10); and types 6-9 have their own case arms, so the indexed access can only ever reach 0-5 of the 6-entry dlx_elf_howto_table. Patrick Monnerat adds that the advisory claims an out-of-bounds write while the procedure performs no indexed write at all. Both observations hold against the 2.45.50.20251201 source. Debian marks it unimportant (binutils not covered by security support) and ships no fix in any suite including forky/sid, so there is nothing to bump.
- Not ratedosv:CVE-2022-50647RISC-V: Make port I/O string accessors actually work
- MediumCVE-2025-21645platform/x86/amd/pmc: Only disable IRQ1 wakeup where i8042 actually enabled it
Other news entries
- 9 Cyber Awareness Tips That Actually Match Today's Maze of ThreatsNewsDark Reading
- PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn'tNewsThe Hacker News
- Microsoft says October updates didn’t actually fix VPN issuesNewsBleepingComputer
- The Sixth Voice of the CISO Data Shows Cyber Risk Has Moved Inside the WorkflowNewsThe Hacker News
- Social Engineering Detection Moves Into the Live ConversationNewsSecurityWeek
- Vulnerability Backlogs Are an Ownership ProblemNewsDark Reading
- Crooks use fake desktop apps to fool HR staff into giving them remote accessNewsThe Register — Security
- DORA Year Two: Can Your SOC Actually See the Attack?NewsThe Hacker News
ID