Zyxel GS1900 Vulnerability: Earlier Patch Left Switches Exploitable

What Happened

The Zyxel GS1900 vulnerability tracked as CVE-2026-107441 is an out-of-bounds write flaw that lets an attacker execute operating system commands on a switch by sending crafted HTTP requests. Researchers at Binarly found that GS1900 switches that received Zyxel's earlier fix, version 2.90, are still open to the exploit that attackers have been using. The exploit works against the switch's web management interface and requires no login. Zyxel has released new firmware for 10 GS1900 models that closes the hole.

This is the kind of issue that hides inside the network stack rather than on a server or workstation. Switches do not get patched as often as servers, and their management interfaces are easy to forget once the device is configured. An unauthenticated command execution on a switch means an attacker can change network settings, capture traffic, or use the switch as a foothold to reach other devices on the network.

The immediate point for this week is straightforward: if any of your clients run a GS1900 that received firmware 2.90, that device is not safe yet. The earlier fix was for a flaw that got blamed for these attacks, but the actual cause was the zero-day. New firmware is available for 10 models, so the next step is to identify those switches and schedule the update.

Timeline

• November 5, 2026The Hacker News reports that the Zyxel GS1900 patch, version 2.90, failed to block the zero-day exploit and that new firmware for 10 models closes the hole.
• November 5, 2026SecurityWeek reports that the switch hacks were blamed on a patched flaw but were actually caused by CVE-2026-107441, an out-of-bounds write flaw.

Who Is Affected

Zyxel GS1900 network switches that received the earlier fix, version 2.90, are affected. That includes 10 GS1900 models for which Zyxel has now released new firmware. The reports do not list the specific model numbers.

Any organization running these switches is exposed if an attacker can reach the web management interface. Switches with management interfaces exposed to the internet are the obvious target, but an attacker who is already inside the network can reach the interface from there as well.

For MSPs, these devices are likely sitting in client server rooms and wiring closets. Network switches are easy to overlook because they sit quietly and do their job for years. This vulnerability is a reminder that network gear needs the same patch and inventory discipline as servers and endpoints.

Why This Matters

This vulnerability matters because it is being actively exploited and the patch that was supposed to address the attacks did not stop them. Any client switch that received version 2.90 is still running code that lets an unauthenticated attacker execute commands.

The exposure depends on where the management interface is reachable. In general, management interfaces should not be exposed to the internet; they should sit behind a VPN or on a dedicated management network. An attacker who can reach the interface does not need credentials, so network segmentation is the main control until the firmware update is applied.

In general, an attacker with command execution on a network switch can alter VLANs, disable ports, intercept traffic, or make changes that survive a reboot. For a client network, that can mean downtime, data exposure, or a persistent foothold for further attacks. The fix here is known and available, so the work is identification and patching.

Zyxel GS1900 Vulnerability: Technical Details

CVE-2026-107441 is an out-of-bounds write flaw in Zyxel GS1900 network switches. According to SecurityWeek, the flaw could allow attackers to execute OS commands via crafted HTTP requests.

According to The Hacker News, the exploit lets anyone who can reach the switch's web management interface run commands on it without logging in. The vulnerability is being actively exploited.

The earlier fix, version 2.90, did not block the exploit. Zyxel has released new firmware for 10 GS1900 models that closes the hole. No other versions or models are listed in the reports.

In general, an out-of-bounds write happens when a program writes data past the end of an allocated memory buffer. In network equipment, this class of bug is a common path to remote code execution because the switch's web server processes attacker-controlled input.

What to Do This Week

1. Inventory every GS1900 switch in your client environments. Record the model and the current firmware version.
2. Check the Zyxel support site for the new firmware for the 10 affected models and download it.
3. Apply the new firmware during a maintenance window, after testing it in a lab or staging environment where possible.
4. Restrict access to the web management interface so it is only reachable from trusted management networks or VPNs, not from the internet.
5. Review switch logs for signs of unauthorized access, especially on any device that received firmware 2.90.
6. Change the admin password on each switch and verify that the management interface is not using default credentials.

What to Tell Clients

Zyxel has released a firmware update for GS1900 switches. The previous update, version 2.90, did not block a vulnerability that attackers are actively exploiting, so any GS1900 that received it still needs attention. We are checking the switches in your environment and will schedule the update.

Until the update is applied, we are making sure the switch management interface is not exposed to the internet. This vulnerability can be exploited without a password, so limiting who can reach the interface is the immediate protection.

After the update, we will confirm the new firmware is in place and check the switches for any signs of tampering.

Frequently Asked Questions

Sources

• Zyxel GS1900 Patch Fails to Block Zero-Day Exploit Allowing Root Command ExecutionHackernews · Reported
• Zyxel Switch Hacks Blamed on Patched Flaw Actually Exploited a Zero-DaySecurityweek · Reported