Zyxel GS1900 Zero-Day Exploited to Compromise Network Switches

Executive Summary

A critical zero-day vulnerability affecting Zyxel GS1900 Series network switches is being actively exploited, with approximately 996 devices reportedly compromised across 48 countries. Tracked as CVE-2026-107441 (CVSS 9.8), the flaw allows unauthenticated attackers to execute commands with root privileges through the web management interface. The vulnerability bypasses an earlier security fix, leaving devices running Patch 2 firmware exposed. Zyxel has released Patch 3 updates to address the issue.

Key Details

Affected Platform

Zyxel GS1900 Series managed network switches.

Attack Surface

Web-based management interface accessible over the network.

Recommended Action

Upgrade immediately to Patch 3 firmware and assess previously exposed devices for compromise.

Affected Environment

The vulnerability affects ten Zyxel GS1900 switch models, including GS1900-8, GS1900-8HP, GS1900-10HP, GS1900-16, GS1900-24, GS1900-24E, GS1900-24EP, GS1900-24HPv2, GS1900-48 and GS1900-48HPv2.

Affected firmware includes the model-specific 2.90 Patch 2 releases and earlier versions. Organisations must upgrade to the corresponding Patch 3 firmware release for each model. Internet-facing and remotely accessible management interfaces present the greatest exposure.

Operational Impact

Successful exploitation can give attackers root-level control over affected switches, enabling unauthorised configuration changes, access to sensitive network information and collection of hashed administrative credentials.

Compromised switches may expose internal network architecture and provide attackers with opportunities for further intrusion. The reported compromise of nearly 1,000 devices demonstrates the operational risk associated with incomplete security patches.

Technical Root Cause

CVE-2026-107441 results from improper validation of HTTP request parameters in the Zyxel GS1900 web management interface, creating an out-of-bounds write condition that can lead to remote code execution.

The vulnerability is associated with an incomplete fix for CVE-2026-7273. Although Patch 2 modified vulnerable code, specially crafted HTTP requests could still trigger exploitation. Patch 3 introduces additional validation to address the bypass.

Recommended Mitigation

Upgrade all affected GS1900 switches to the appropriate Patch 3 firmware.
Inventory managed switches and identify internet-accessible management interfaces.
Restrict management access using VLANs, firewall rules and IP allowlisting.
Review device configurations and administrative accounts for unauthorised changes.
Rotate potentially exposed administrative credentials.
Monitor logs for suspicious management access, configuration exports and command execution.
Conduct compromise assessments on previously exposed switches.
Validate that deployed patches fully remediate identified vulnerabilities.

Concerned about your exposure?

Our security experts can help you assess affected systems, validate risk and support a safe remediation plan.

Discuss Your Security Exposure Identify Vulnerabilities Before Attackers Exploit Them

Assess your risk

Identify affected systems

Plan remediation

Practical, vendor-aligned guidance

Get expert support

From our 24/7 security team

Stay ahead of emerging threats

Get the latest threat intelligence and security advisories from Smarttech247.

Full Technical Report

Download the complete analysis, including detailed technical findings and references.

Download Full Report (PDF)

References

BleepingComputer — Zyxel zero-day exploitation

The Hacker News — Zyxel GS1900 patch bypass