Zyxel patches exploited flaw in GS1900 network switches

CVE explainers: CVE-2026-7273

TL;DR - Update: BleepingComputer reports that attackers exploited CVE-2026-107441 and compromised 996 devices across 48 countries; Zyxel’s patches were released on October 22, 2026. - Zyxel released patches for CVE-2026-107441, an out-of-bounds write vulnerability in the CGI program of GS1900 series switch firmware. - Zyxel says a LAN-based, unauthenticated attacker could potentially execute OS commands through a crafted HTTP request. - Ten GS1900 models are affected. The fixed versions are listed below. - CVE-2026-107441 is separate from the earlier CVE-2026-7273 issue, so an update for the earlier vulnerability does not replace the new patch.

What happened#

Zyxel published an advisory on 2026-11-3 for CVE-2026-107441, an out-of-bounds write vulnerability in the CGI program of GS1900 series switch firmware. Zyxel says the issue could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands through a crafted HTTP request. Zyxel advises users to install the patches for optimal protection. Zyxel’s advisory

BleepingComputer reports that Zyxel released the security updates on October 22 and published the advisory on November 3. It reports that attackers had exploited the flaw to compromise 996 devices across 48 countries. The reported activity involved remote command execution followed by a script that collected device configurations, hashed root credentials, and network information. BleepingComputer reports.

The affected products are ten GS1900 models. Zyxel says on-market products not listed in its table remain unaffected. The advisory credits Yegor Vasilenko and Fernando Mercês from Binarly for reporting the issue.

The incident follows CVE-2026-7273, an earlier GS1900 vulnerability that Zyxel described as a stack-based buffer overflow. BleepingComputer reports that the exploit used in the attacks remained effective against firmware releases patched for CVE-2026-7273. Zyxel identifies CVE-2026-107441 as a separate vulnerability, so devices updated for the earlier issue must be checked against the newer advisory as well.

Are you affected#

Organizations may be affected if they operate one of the ten GS1900 models listed by Zyxel and the device runs one of the affected firmware versions.

For CVE-2026-107441, Zyxel lists these affected and patched versions:

The earlier Zyxel advisory lists these preceding vulnerable versions and patches for CVE-2026-7273:

What is confirmed and what is reported#

What defenders should do now#

1. Identify all deployed Zyxel GS1900 switches, including each device’s exact model and firmware version.

2. Compare each device with Zyxel’s affected-version and patch table for CVE-2026-107441. The fixed versions are listed in Zyxel’s advisory.

3. Install the patched firmware listed by Zyxel for affected devices. Zyxel advises users to install the patches for optimal protection.

4. Check devices that received the earlier CVE-2026-7273 update separately. BleepingComputer reports that the later exploit remained effective against firmware releases patched for that earlier vulnerability.

5. Review switch configurations, hashed root credentials, and network information for unexpected access or changes. This is relevant because BleepingComputer reports that attackers collected those categories of data.

6. Contact a local Zyxel service representative or visit Zyxel’s Community for further information or assistance, as recommended in the advisory.

This advisory is informational and is updated as vendors publish details. Confirm versions and actions against the vendor’s own guidance for your environment.

Sources

• Primary notice: zyxel.com
• Primary notice: zyxel.com
• Primary notice: tryhackme.com
• Report: bleepingcomputer.com