Skip to content
eastbaycyber

Disclosure: this page contains affiliate links. East Bay Cyber may earn a commission if you buy through them, at no extra cost to you. That never changes how we rank products. Editorial policy.

Zyxel patches GS1900 switch flaw exploited in attacks

Breaking news 5 min read
EC
East Bay Cyber Editorial Team Updated Developing story
Built from the vendor or authority notice plus independent reporting; unconfirmed claims are labeled as reported. Human-reviewed after publishing.

CVE explainers: CVE-2026-7273

TL;DR - Zyxel released patches for CVE-2026-107441, an out-of-bounds write vulnerability in GS1900 series switch firmware. - Zyxel says a LAN-based, unauthenticated attacker could potentially execute OS commands through a crafted HTTP request. - BleepingComputer reports that attackers compromised 996 devices across 48 countries. - The affected models and patched firmware are listed in Zyxel’s security advisory.

What happened#

Zyxel published an advisory on 2026-11-3 for an out-of-bounds write vulnerability in the CGI program of GS1900 series switch firmware. Zyxel identifies the issue as CVE-2026-107441 and says it could allow a LAN-based, unauthenticated attacker to potentially execute OS commands through a crafted HTTP request.

Zyxel lists ten affected models and provides patched firmware for each. The affected firmware includes the listed version and earlier versions. Zyxel says on-market products not listed in its table remain unaffected.

The affected models are GS1900-8, GS1900-8HP, GS1900-10HP, GS1900-16, GS1900-24, GS1900-24E, GS1900-24EP, GS1900-24HPv2, GS1900-48, and GS1900-48HPv2. The advisory credits Yegor Vasilenko from Binarly for reporting the issue.

BleepingComputer reports that the flaw was exploited against GS1900 switches and that the attacks compromised 996 devices across 48 countries. It reports that attackers executed commands remotely, then downloaded a script that collected device configurations, hashed root credentials, and network information. These attack details have not been stated in Zyxel’s advisory.

The incident follows an earlier GS1900 vulnerability, CVE-2026-7273. In its June 16 advisory, Zyxel described that issue as a stack-based buffer overflow that could also allow a LAN-based, unauthenticated attacker to potentially execute OS commands through a crafted HTTP request.

Are you affected#

Organizations may be affected if they operate one of the ten GS1900 models listed by Zyxel and the device runs one of the affected firmware versions.

For CVE-2026-107441, Zyxel lists these affected and patched versions:

Model Affected version Patch
GS1900-8 2.90(AAHH.2)C0 and earlier 2.90(AAHH.3)C0
GS1900-8HP 2.90(AAHI.2)C0 and earlier 2.90(AAHI.3)C0
GS1900-10HP 2.90(AAZI.2)C0 and earlier 2.90(AAZI.3)C0
GS1900-16 2.90(AAHJ.2)C0 and earlier 2.90(AAHJ.3)C0
GS1900-24 2.90(AAHL.2)C0 and earlier 2.90(AAHL.3)C0
GS1900-24E 2.90(AAHK.2)C0 and earlier 2.90(AAHK.3)C0
GS1900-24EP 2.90(ABTO.2)C0 and earlier 2.90(ABTO.3)C0
GS1900-24HPv2 2.90(ABTP.2)C0 and earlier 2.90(ABTP.3)C0
GS1900-48 2.90(AAHN.2)C0 and earlier 2.90(AAHN.3)C0
GS1900-48HPv2 2.90(ABTQ.2)C0 and earlier 2.90(ABTQ.3)C0

The earlier advisory lists the preceding vulnerable versions and patches for CVE-2026-7273. A device updated to a patch for that earlier issue should still be checked against Zyxel’s separate CVE-2026-107441 table.

What is confirmed and what is reported#

Claim Source Status
CVE-2026-107441 is an out-of-bounds write vulnerability in GS1900 series switch firmware. Zyxel Confirmed
The flaw could allow a LAN-based, unauthenticated attacker to potentially execute OS commands through a crafted HTTP request. Zyxel Confirmed
Zyxel released patches for the ten listed GS1900 models. Zyxel Confirmed
Attackers exploited the vulnerability and compromised 996 devices across 48 countries. BleepingComputer Reported
Attackers collected device configurations, hashed root credentials, and network information. BleepingComputer Reported
The earlier GS1900 issue was CVE-2026-7273, a stack-based buffer overflow vulnerability. Zyxel Confirmed
The vulnerability was reported to Zyxel by Yegor Vasilenko from Binarly. Zyxel Confirmed

What defenders should do now#

  1. Identify all deployed Zyxel GS1900 switches, including their exact model and firmware version.

  2. Compare each device with the affected-version and patch-availability table in Zyxel’s advisory.

  3. Install the patched firmware listed by Zyxel for affected devices. Zyxel advises users to install the patches for optimal protection.

  4. Check devices that received the earlier CVE-2026-7273 update separately, because Zyxel identifies CVE-2026-107441 as a separate vulnerability with separate patches.

  5. Review switch configurations, credentials, and network information for unexpected changes or access, taking into account BleepingComputer’s report that attackers collected those categories of data.

  6. Contact a local Zyxel service representative or visit Zyxel’s Community if assistance is required, as recommended in the advisory.

This advisory is informational and is updated as vendors publish details. Confirm versions and actions against the vendor’s own guidance for your environment.

Sources

Last verified: 2026-11-05

Disclaimer: This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.