Back

Zyxel Patches GS1900 Flaw Linked to Reported Attacks

lite News Desk 2 min read

Patches are available for CVE-2026-107441, a firmware vulnerability affecting 10 Zyxel GS1900 switch models, according to the company’s November 3, 2026, security advisory. BleepingComputer reported exploitation of the flaw, citing GreyNoise’s observation of attack activity beginning around August 17, 2026.

Zyxel identifies the vulnerability as an out-of-bounds write in the firmware’s CGI program. According to its advisory, an attacker on the local network would not need authentication and could send a specially constructed HTTP request that might allow operating-system commands to run.

GreyNoise reported compromises involving 996 Zyxel switches in 48 countries. BleepingComputer said subsequent analysis identified CVE-2026-107441 as the target of a recovered exploit, replacing the earlier identification of CVE-2026-7273. That finding does not establish that CVE-2026-107441 was used in every one of the 996 compromises.

The two vulnerabilities are distinct. In an advisory dated June 16, 2026, Zyxel identified CVE-2026-7273 as a stack-based buffer overflow affecting GS1900 switches. BleepingComputer reported that a fix for that vulnerability preceded identification of the later exploitation.

According to BleepingComputer’s account of Binarly’s analysis, the recovered exploit remained effective against each of the 10 firmware releases issued to address CVE-2026-7273. Binarly attributed that result to a separate weakness: although the earlier update protected against the older overflow, the exploit could alter a parameter counter before validation and take advantage of absent HTTP parameter-length checks.

Zyxel’s release notes identify the.3 firmware releases as containing fixes for CVE-2026-107441. BleepingComputer placed the release date at October 22, 2026, separate from the November advisory’s publication.

The advisory’s affected-version table pairs GS1900-8 with 2.90(AAHH.2)C0 and GS1900-8HP with 2.90(AAHI.2)C0. For GS1900-10HP, it lists 2.90(AAZI.2)C0; the GS1900-16 entry specifies 2.90(AAHJ.2)C0. The corresponding entries for GS1900-24 and GS1900-24E are 2.90(AAHL.2)C0 and 2.90(AAHK.2)C0.

For GS1900-24EP, the listed version is 2.90(ABTO.2)C0, while GS1900-24HPv2 is paired with 2.90(ABTP.2)C0. The table identifies 2.90(AAHN.2)C0 for GS1900-48 and 2.90(ABTQ.2)C0 for GS1900-48HPv2. Zyxel includes earlier firmware versions within the affected scope for these models and provides a corresponding.3 patch for each.

According to Zyxel, patch coverage applies to models that remain within its vulnerability support period. The company also states that models currently on the market but absent from the advisory’s table are unaffected.

* This article is based on publicly available information at the time of writing.

More from Cybersecurity

  1. Ubuntu’s proposed kernels for three LTS releases remain in qualification testing and are not included in upgrades by default.

  2. The NCSC says attackers are likely to use AI to target known flaws in older infrastructure technology by 2028.

  3. Binance said its zero-knowledge proof for ten tokens was expected by November 3, with checks showing backing of at least 1:1.

  4. Binance said it had replenished about 90% of the affected assets by October 31, with its treasury and user fund covering the losses.

  5. Drupal recommends updating Commerce Core to a fixed release and reviewing orders for inconsistencies.