Zyxel has fixed CVE-2026-107441, a previously unknown flaw in the web management interface of its GS1900 series network switches. It is an out-of-bounds write in the switch firmware’s CGI program: a crafted HTTP request lets an unauthenticated attacker run operating-system commands on the device. Zyxel’s advisory describes the attacker as LAN-based; BleepingComputer describes it as an unauthenticated attacker with network access. Zyxel shipped new firmware on October 22 and published the advisory on November 3.
According to BleepingComputer, the flaw was used in real attacks before anyone knew it existed. Starting around August 17, GreyNoise saw a suspected Chinese-speaking actor it tracks as Kapibala compromise 996 switches in 48 countries, then pull down a script that collected device configurations, hashed root credentials and network information. GreyNoise tied the activity to the Red Heron campaign and blamed CVE-2026-7273, a GS1900 flaw Zyxel had patched in June; CISA added that CVE to its Known Exploited Vulnerabilities catalog on September 21. Researchers at Binarly then found an exposed archive of the attackers’ exploit, saw that it specifically checked for firmware already patched for CVE-2026-7273, and confirmed on September 28 that it still worked against all ten of those patched firmware releases. Binarly reported it to Zyxel on September 29, and Zyxel confirmed a new vulnerability on October 11. BleepingComputer says it is unclear whether the exploit was built to get around the June fix or abused a related bug that the earlier patch missed. Zyxel treats the two as separate flaws.
How to check if you’re affected
Affected devices are Zyxel GS1900 series switches. Zyxel’s advisory lists ten affected models, each vulnerable on the listed firmware “and earlier”, with a fixed release one build later:
- GS1900-8: 2.90(AAHH.2)C0 and earlier; fixed in 2.90(AAHH.3)C0
- GS1900-8HP: 2.90(AAHI.2)C0 and earlier; fixed in 2.90(AAHI.3)C0
- GS1900-10HP: 2.90(AAZI.2)C0 and earlier; fixed in 2.90(AAZI.3)C0
- GS1900-16: 2.90(AAHJ.2)C0 and earlier; fixed in 2.90(AAHJ.3)C0
- GS1900-24: 2.90(AAHL.2)C0 and earlier; fixed in 2.90(AAHL.3)C0
- GS1900-24E: 2.90(AAHK.2)C0 and earlier; fixed in 2.90(AAHK.3)C0
- GS1900-24EP: 2.90(ABTO.2)C0 and earlier; fixed in 2.90(ABTO.3)C0
- GS1900-24HPv2: 2.90(ABTP.2)C0 and earlier; fixed in 2.90(ABTP.3)C0
- GS1900-48: 2.90(AAHN.2)C0 and earlier; fixed in 2.90(AAHN.3)C0
- GS1900-48HPv2: 2.90(ABTQ.2)C0 and earlier; fixed in 2.90(ABTQ.3)C0
Zyxel says on-market products not in its table are unaffected. Check the firmware version shown on your switch against the table and install the latest release for your model; BleepingComputer’s advice to administrators is the same. Because the June patch did not stop this exploit, a switch that is already on the June firmware is still exposed until it is updated again.
The sources describe configuration and hashed root credentials being collected from compromised switches, but neither Zyxel’s advisory nor BleepingComputer gives indicators for spotting a compromised device. If a switch’s management page was reachable by untrusted networks in the past months, treat its stored credentials as exposed and change them after updating; that is a cautious step, not guidance from Zyxel.
Sources
- Zyxel: security advisory for out-of-bounds write vulnerability in GS1900 series switches (CVE-2026-107441)
- Binarly: New Zyxel GS1900 pre-auth RCE vulnerability revealed
- Zyxel: security advisory for the June GS1900 flaw (CVE-2026-7273)
- BleepingComputer: Zyxel fixes zero-day exploited to hack nearly 1,000 network switches