Zyxel GS1900 CVE-2026-107441: zero-day used in attacks
CVE-2026-107441 enables unauthenticated takeover of Zyxel GS1900 switches. Check affected models, fixed firmware and post-incident actions.
- AUTHOR
- Karol Rapacz / CEO Breachroad · OSCP · PNPT
- PUBLISHED
- 6 November 2026
- READING TIME
- 10 min read
- TOPIC
- Vulnerabilities and CVEs
New vulnerability CVE-2026-107441 in Zyxel GS1900 switches allows an attacker who can reach the management network to send a crafted HTTP request and potentially execute operating-system commands without authentication. The issue is urgent because Binarly found a working exploit on attacker infrastructure and confirmed that the earlier CVE-2026-7273 patch did not stop it.
Zyxel has released fixed 2.90(… .3)C0 firmware for ten GS1900 models. A release ending in .2)C0 or earlier remains exposed to the new flaw even if the June update was installed.
The priority action: identify the exact model and firmware, deploy the corresponding .3)C0 build, restrict the web interface to a dedicated administration network and investigate unusual outbound traffic from the switch. A device showing compromise indicators also requires rotation of credentials and secrets stored in its configuration.
What happened to Zyxel GS1900 switches
The original campaign was associated with CVE-2026-7273. GreyNoise reported theft of configurations, network data and root password hashes from 996 switches in 48 countries. Those figures belong to activity that was attributed to the older CVE at the time.
Binarly later analysed the recovered exploit and demonstrated that it still worked against all ten firmware releases intended to address CVE-2026-7273. The researchers concluded that the code targeted a different, previously unpatched weakness. After disclosure, the vendor assigned CVE-2026-107441 and prepared another set of updates.
That distinction matters. The 996 cases should not automatically be relabelled as confirmed victims of the new CVE because GreyNoise’s original evidence used the older identifier. Binarly nevertheless shows that the attacker’s exploit bypassed the June protection. Operationally, a switch running only the .2)C0 build still needs remediation.
How CVE-2026-107441 works
Zyxel describes an out-of-bounds write in the CGI program behind the web interface. A LAN-based, unauthenticated attacker can send a crafted HTTP request and potentially execute operating-system commands.
The vendor gives the flaw a CVSS 3.1 score of 8.8. Its vector assumes adjacent-network access, no privileges and no user interaction. The practical question is therefore which systems can reach the switch management interface. A flat network, user access to the administration VLAN or an internet-exposed panel substantially increases risk.
Binarly says the new root cause involves validation of request parameter count and length. The earlier fix checked the counter too late, allowing crafted input to corrupt memory before validation. This is why closing the incident after the June update was not enough.
Affected models and fixed Zyxel firmware
| GS1900 model | Affected versions | Fixed version |
|---|---|---|
| GS1900-8 | through 2.90(AAHH.2)C0 | 2.90(AAHH.3)C0 |
| GS1900-8HP | through 2.90(AAHI.2)C0 | 2.90(AAHI.3)C0 |
| GS1900-10HP | through 2.90(AAZI.2)C0 | 2.90(AAZI.3)C0 |
| GS1900-16 | through 2.90(AAHJ.2)C0 | 2.90(AAHJ.3)C0 |
| GS1900-24 | through 2.90(AAHL.2)C0 | 2.90(AAHL.3)C0 |
| GS1900-24E | through 2.90(AAHK.2)C0 | 2.90(AAHK.3)C0 |
| GS1900-24EP | through 2.90(ABTO.2)C0 | 2.90(ABTO.3)C0 |
| GS1900-24HPv2 | through 2.90(ABTP.2)C0 | 2.90(ABTP.3)C0 |
| GS1900-48 | through 2.90(AAHN.2)C0 | 2.90(AAHN.3)C0 |
| GS1900-48HPv2 | through 2.90(ABTQ.2)C0 | 2.90(ABTQ.3)C0 |
Download firmware for the exact model from Zyxel’s official support site. Matching only the major 2.90 release is insufficient; the complete build string and .3)C0 suffix matter.
What organisations should do
1. Build an accurate device inventory
Collect model, serial number, firmware, management address, physical location, business owner and every network that can reach the panel. Include spare devices and switches in small branches, which often fall outside central asset records.
2. Update even if the June patch is installed
The .2)C0 release does not address CVE-2026-107441. Move to the correct .3)C0 variant through a controlled change, back up the configuration and confirm the running version after reboot.
3. Isolate the management interface
The web panel should be reachable only from a dedicated management VLAN or controlled jump host. Block management from user networks, guest Wi-Fi and the internet. Segmentation does not replace patching, but it reduces the number of systems able to reach the flaw. Our internal network segmentation guide provides a broader testing approach.
4. Hunt for evidence and treat the configuration as potentially exposed
Review firewall, flow and DNS logs for unexpected connections initiated by the switch, especially transfers to unknown systems. Investigate management access outside the authorised range, new accounts, ACL changes, port mirroring and configuration modifications.
Installing a patch does not reverse earlier attacker actions. If compromise is plausible, use a trusted firmware image, validate the configuration and rotate administrator passwords, SNMP communities, RADIUS or TACACS keys and other secrets stored on the device.
Source facts and Breachroad conclusions
Zyxel confirms the CGI flaw, ten affected models, potential command execution by an unauthenticated LAN-based attacker and .3)C0 fixed releases. Binarly confirms finding the exploit on attacker infrastructure and successful testing against the previously patched firmware. GreyNoise supplies the figure of 996 compromised devices from the campaign originally attributed to CVE-2026-7273.
The remediation order, rotation of every stored secret, trusted-image recovery and network-side investigation are Breachroad defensive recommendations. Organisations can rehearse these decisions through corporate cybersecurity training, while an IT security audit can validate actual device exposure and segmentation.
FAQ: CVE-2026-107441 and Zyxel GS1900
Is the June CVE-2026-7273 update sufficient?
No. Binarly demonstrated that the recovered exploit worked against all ten releases carrying the earlier fix. CVE-2026-107441 requires the appropriate firmware ending in .3)C0.
Does an attacker need an administrator password?
No. Zyxel describes an unauthenticated attack, although the adversary must be able to reach the panel from the LAN. Restricting the management interface is therefore an important defence layer.
Is CVE-2026-107441 in the CISA KEV catalogue?
The new identifier was not in KEV at publication time. The older CVE-2026-7273 is listed. Absence of the new entry does not override Binarly’s evidence that the exploit was used as a zero-day.
Should credentials be changed after updating?
Yes if the interface was reachable by untrusted systems or compromise indicators exist. Rotate not only the administrator account but also secrets stored in the configuration and shared with other systems.
Primary sources: Zyxel — CVE-2026-107441 advisory, Binarly — GS1900 exploit analysis, Binarly — BRLY-2026-057, GreyNoise — GS1900 campaign research.
