Hackers Exploit Zyxel GS1900 Zero-Day Vulnerability
Attackers compromised nearly 1,000 Zyxel GS1900 switches via pre-authentication RCE before Zyxel patched the flaw.
85
Vulnerability1 · 1 read
CVE-2026-107441
Out-of-bounds write in Zyxel GS1900-24E CGI up to 2.90(AAHK.2)C0
- CVSS 3.1
- 8.8 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
An out-of-bounds write in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 allows unauthenticated adjacent attackers to execute OS commands via crafted HTTP requests. This affects users running vulnerable firmware on the switch. Attackers gain command execution capabilities.
What to do: Apply Zyxel's update for CVE-2026-107441. No workaround available.
| Product | Affected |
|---|---|
| Zyxel GS1900-24E | through 2.90(AAHK.2)C0 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 could allow an unauthenticated adjacent attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.
- Weakness
- CWE-787
- Vector
- CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
In the news
10 storiesZyxel Patches Zero-Day Vulnerability in GS1900 Switches
Zyxel released firmware updates for CVE-2026-107441 affecting GS1900 switches after it was exploited in 48 countries.
80
Hackers Exploit Zyxel GS1900 Zero-Day in the Wild
Patch for CVE-2026-7273 left switches vulnerable to new CVE-2026-107441 remote root command execution.
80
Zyxel GS1900 June patch missed flaw behind attacks on 996 switches
Binarly says all 10 June firmware releases still allow unauthenticated root commands; Zyxel shipped a later fix.
78
Zyxel GS1900 switches remain vulnerable to root command execution
Zyxel GS1900 Patch 2 fails to block zero-day allowing unauthenticated root access; Patch 3 fixes CVE-2026-107441
75
Zyxel fixes zero-day exploited to hack nearly 1,000 network switches
Zyxel patched CVE-2026-107441 after Kapibala exploited it to compromise 996 GS1900 switches and steal credentials; the flaw bypassed a prior patch for CVE-2026-7273.
75
Weekly recap: OpenSSH SSHole probed, Zyxel zero-day hits switches
Twenty OpenSSH attempts came from 13 IPs, and a Zyxel flaw was used on nearly 1,000 switches.
74
Zyxel GS1900 zero-day exploited in wild despite patch
Attackers used CVE-2026-107441 to compromise nearly 1,000 Zyxel switches after it was misattributed to a patched flaw.
70
Patched Zyxel GS1900 switches remain open to CVE-2026-107441 exploit
Binarly discovered the CVE-2026-107441 exploit still works on firmware fixed for a different CVE.
55
Refrigeration cyberattacks hit European retailers again, Patch Tuesday forecast
AI agents, botnets and security updates rounded up for the week.
15