Zyxel GS1900 Switch Vulnerability: Patch Missed It
A Zyxel GS1900 switch vulnerability shows why “patched” on an asset list is not proof of safety: switches that already carried Zyxel’s June fix stayed open to the exploit attackers actually used. Binarly traced the attacks to a second flaw, CVE-2026-107441 (CVSS 8.8 per SecurityWeek, 9.8 per Binarly). Zyxel fixed it on October 22 with firmware 2.90 Patch 3 and published an advisory on November 3.
What Happened With the Zyxel GS1900 Switch Vulnerability
In June, Zyxel patched CVE-2026-7273, a stack-based buffer overflow in the web interface of GS1900 switches, in firmware 2.90 Patch 2. On September 21, GreyNoise reported that a Chinese-speaking threat actor had used an exploit around August 17 to take configuration data, network details and hashed root credentials from 996 of these switches in 48 countries. According to GreyNoise, 564 of them still ran factory default credentials. CISA added CVE-2026-7273 to its Known Exploited Vulnerabilities catalog the same day.
Binarly then found the attacker’s exploit on the actor’s own infrastructure and tested it. It still gave unauthenticated command execution on all ten firmware releases that carried the June fix, because it targets a different bug: an out-of-bounds write in the CGI program of the web interface. Binarly reported it to Zyxel on September 29, and Zyxel confirmed it on October 11. Binarly says it also tested the exploit on real hardware. As of November 6, it had said it would publish a minimized proof of concept but had not yet released it. SecurityWeek, citing Binarly, reports that the attacks were carried out with this previously unknown flaw.
Zyxel’s advisory lists ten models, from GS1900-8 to GS1900-48HPv2. Every build up to 2.90(xxxx.2)C0 is affected; the fix is the matching 2.90(xxxx.3)C0 build. Zyxel describes the attacker as unauthenticated and LAN-based, sending a crafted HTTP request; Binarly’s advisory describes a remote attacker and root-level command execution. As of November 6, CISA’s catalog lists CVE-2026-7273 but not CVE-2026-107441.
Why It Matters
The GS1900 is a small-business and branch-office switch, the kind that sits in an office, a shop or a hotel and is rarely on anyone’s patch calendar. The stolen data is a map of the network plus password hashes, which attackers can try to crack offline and reuse elsewhere. Assumption: most mid-sized companies track server and firewall versions, but not switch firmware.
There is also an audit problem. An inventory that says “Patch 2 installed” answered the question about the CVE in the news, not the question about the path attackers used. NIS2-covered organisations are expected to handle vulnerabilities in network equipment, and a closed ticket for the wrong flaw does not hold up well in an audit. We covered the same edge-device pattern in the Cisco ASA and FTD and Synology NAS posts this month.
What You Should Do Now
- Find every GS1900 switch, including those in branch offices and managed by third parties, and read its firmware version. Update to the 2.90 Patch 3 build for your model (the version string ends in .3)C0). Patch 2 is not enough.
- Keep the web management interface off the internet and away from untrusted segments; put it in a management VLAN. Change every factory default credential.
- If a switch ran Patch 2 or earlier while its management interface was reachable, rotate its admin credentials and any password reused elsewhere, and compare the configuration with your last known good copy for unknown accounts or changes.
- Check network logs for unexpected outbound connections from switches. Binarly lists hashes and command-and-control addresses for the malware involved; Zyxel’s advisory lists no indicators for this flaw.
DIESEC Perspective
We treat network equipment as exposed until the fix for the exploited path is confirmed, not only the CVE that made the news. Binarly reached its result by testing the firmware itself, which is out of reach for most teams, so a practical minimum is a firmware inventory that records the exact build and a reachability check for every management interface.
Not sure which of your switches run an exploitable build? Contact DIESEC for a firmware and exposure review of your network devices.
Sources: Zyxel advisory | SecurityWeek | Help Net Security | Help Net Security (September) | CISA KEV catalog
Published: 2026-11-09 | Category: Vulnerabilities & Patches | ~4 min read
