Zyxel Patches Zero-Day Vulnerability in GS1900 Switches
Original title: Zyxel patches a zero-day hiding behind an old fix
Zyxel released firmware updates for CVE-2026-107441 affecting GS1900 switches after it was exploited in 48 countries.
Zyxel has patched a zero-day vulnerability in its GS1900 network switches that attackers exploited to compromise devices across 48 countries. The flaw, CVE-2026-107441, allows unauthenticated remote code execution. Zyxel released fixes on October 22.
Unconfirmed: Exact number of devices compromised not confirmed
- Attacks targeted 996 GS1900 switches in 48 countries
- CVSS 8.8 out-of-bounds write vulnerability
- Initial blame on CVE-2026-7273 which was already patched
- Binary researchers reported the new flaw on September 29
- 1.Update to firmware version ending in .3C0
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-107441 | Out-of-bounds write in Zyxel GS1900-24E CGI up to 2.90(AAHK.2)C0 | 8.8 | — |
From the original article
1 min read at csoonline.com
Zyxel has patched a zero-day vulnerability that attackers exploited to compromise 996 GS1900 network switches across 48 countries, exposing device configurations, network information and hashed root credentials. The attack began around August 17, according to cybersecurity firm GreyNoise, but researchers initially blamed a different vulnerability that Zyxel had already addressed.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.