CYBUNKR

Zyxel GS1900 switches:June’s fix did not stop the exploit attackers were using

Published

The exploit used to break into Zyxel GS1900 switches still worked on the firmware patched in June. The real hole, CVE-2026-107441, is fixed in 2.90 Patch 3. Update and change the admin password.

If you have a Zyxel GS1900 series switch, update its firmware to 2.90 Patch 3 today, even if you installed Zyxel's June security fix. CVE-2026-107441 lets an attacker who can reach the switch's web management page run commands on it without logging in (Zyxel).

Binarly recovered the exploit that attackers used against these switches this autumn and found it still worked on every firmware release that carried the June fix (Binarly). The patch closed a different bug from the one the exploit relies on (Help Net Security).

Who is affected

  • GS1900-8, -8HP, -10HP, -16, -24, -24E, -24EP, -24HPv2, -48 and -48HPv2 on firmware 2.90 Patch 2, shown as 2.90(XXXX.2)C0, or earlier. Patch 3, 2.90(XXXX.3)C0, fixes it, for example 2.90(AAHL.3)C0 on the GS1900-24 (Zyxel).
  • Zyxel says it released patches for models “still within their vulnerability support period” (Zyxel). If you have an older GS1900 that is not in its table, ask Zyxel whether it is affected, and replace it if no fix is coming.
  • Zyxel rates it 8.8 out of 10 and describes the attacker as “LAN-based” (CVE record). That was no barrier for one attacker, who took data from 996 GS1900 switches in 48 countries (GreyNoise).

What has been seen so far

A snapshot from 6 November:

  • On 16 June Zyxel fixed CVE-2026-7273, a buffer overflow in the same web management program (Zyxel).
  • In September GreyNoise reported that an attacker had exploited GS1900 switches with a new exploit, tied it to CVE-2026-7273, and counted 996 switches in 48 countries from which data was taken (GreyNoise). CISA added CVE-2026-7273 to its Known Exploited Vulnerabilities catalog on 21 September. The stolen data included switch configuration, network details and hashed root-level credentials (Help Net Security).
  • Binarly found the same attacker's exploit on its server, and on 28 September confirmed it still ran commands without a login on all ten firmware releases fixed in June. Zyxel confirmed the new flaw, released Patch 3 firmware on 22 October and published its advisory on 3 November (Binarly, Zyxel Community, Zyxel).
  • CVE-2026-107441 itself is not yet in CISA's catalog. Binarly says it will publish a cut-down proof-of-concept exploit (Binarly). CIRCL's Vulnerability-Lookup logged an exploitation report on 6 November.

What to do

  • Check the firmware version on each GS1900's web page and install 2.90 Patch 3 from Zyxel (Zyxel, Zyxel Community).
  • Keep the management page off the internet and away from guest and staff networks: only a management VLAN or named admin PCs should reach it.
  • After updating, change the switch admin password, and anywhere else it was reused. Hashed credentials were among the data taken (Help Net Security).
  • Look for signs of compromise (Help Net Security): compare the configuration with a known-good backup and look for admin accounts or settings you didn't add. If you find any, reset the switch, update it and rebuild its configuration.
  • Network run by an IT provider? Ask them which GS1900 switches you have and which firmware each is on today.

How we can help

Not sure what is on your network, or whether a switch has been tampered with? Get in touch.

Sources