Zyxel has patched a previously unknown vulnerability in its GS1900 smart managed switches after researchers found that the exploit used against nearly a thousand devices still worked on firmware that administrators believed had already fixed the problem. The flaw, now tracked as CVE-2026-107441, affects ten GS1900 models and lets an unauthenticated attacker run operating system commands with root privileges through the switches' web management program.
The campaign behind the discovery was substantial. Threat intelligence firm GreyNoise reported in September that an attacker had compromised 996 GS1900 switches across 48 countries in activity that began around August 17, collecting device configurations, hashed root credentials, and network information. That combination is valuable to an intruder: a configuration file maps how a network is built, and hashed credentials can be attacked offline and potentially reused to move deeper into an organization's infrastructure.
At the time, the attacks were tied to a different vulnerability, CVE-2026-7273, a stack-based buffer overflow in the same web management program that Zyxel fixed on June 16 and rated 8.8 in severity. The U.S. Cybersecurity and Infrastructure Security Agency added that earlier flaw to its Known Exploited Vulnerabilities catalog on September 21, the same day GreyNoise reported the campaign, which reinforced the assumption that the June firmware was the answer.
Firmware security firm Binarly tested that assumption. Its researchers analyzed an obfuscated Python exploit matching the one GreyNoise had described and confirmed on September 28 that all ten firmware releases shipped as the June fix remained vulnerable to it. Binarly said the June change added a check, but the check ran only after the unsafe copy had already occurred, so the change did not address the underlying vulnerability. The firm reported the separate flaw to Zyxel on September 29.
The new vulnerability is an out-of-bounds write in the switches' web management program, triggered through specially crafted HTTP requests. Zyxel rates CVE-2026-107441 at 8.8 and says an attacker must be on the local network to exploit it, while Binarly rates it 9.8 and says exploitation requires only network access to the switch's management service. That disagreement affects how urgently teams should treat exposed management interfaces, but it does not change the required action. On the GS1900-8, for example, firmware 2.90(AAHH.2)C0 and earlier is affected, and the version ending in .3C0 contains the fix. The affected range also includes models such as the GS1900-24 and GS1900-48.
Zyxel confirmed the flaw on October 11, released fixed firmware on October 22, and published its advisory on November 3, telling users to install the updates for optimal protection. Critically, its advisory lists the June releases among the affected versions, so a switch that was diligently updated in June is not protected until it receives the October firmware.
For network teams, the lesson extends beyond one vendor. A device that reports a patched firmware version is not necessarily a device that has been fixed, especially when two similar flaws live in the same component. Administrators should inventory every GS1900 in service, check the exact firmware build for each model, apply the October release, and treat any switch that may have been reachable during the campaign as potentially exposed, including reviewing its configuration and credentials. Restricting switch management interfaces to a dedicated management network, rather than leaving them broadly reachable, also limits what a flaw like this one can reach the next time a patch turns out to be incomplete.