Vulnerabilities
Zyxel patches zero-day flaw in GS1900 switches after nearly 1,000 devices hit
Attackers exploited a new vulnerability in Zyxel GS1900 switches, compromising 996 devices in 48 countries. Zyxel has now released a patch and urges admins to update.
Ross Grant2 min read
The short version
A serious security flaw was found in Zyxel GS1900 network switches. Attackers broke into nearly 1,000 devices in 48 countries, stealing network details and scrambled passwords. Even devices with a previous security update were at risk. Zyxel has now released a fix, and anyone using these switches should update them right away.
By the numbers
- 996GS1900 switches compromisedCSO Online
- 48countries affectedCSO Online
What happened?
Attackers exploited a new vulnerability in Zyxel GS1900 network switches, compromising 996 devices in 48 countries. The flaw allowed attackers to access device configurations, network information, and hashed root credentials. Zyxel has released a patch and urges administrators to update affected devices.
Who is affected
Attackers compromised 996 Zyxel GS1900 network switches in 48 countries, according to CSO Online (opens in a new tab). The affected models include ten variants, such as GS1900-8, GS1900-24, and GS1900-48. Devices running firmware versions ending in .2C0 or earlier are vulnerable. Even switches that had received a previous security update in June were still at risk.
How the flaw works
The vulnerability, now tracked as CVE-2026-107441, is an out-of-bounds write bug in the web management interface of these switches. This means an attacker can send specially crafted HTTP requests to the device, allowing them to run operating system commands without needing to log in. The flaw has a CVSS score of 8.8, which is considered high severity. Attackers only need network access to the device to exploit it.
How the attack worked
The attack started around 17 August 2026, according to security firm GreyNoise. At first, researchers thought the attackers were using a different bug (CVE-2026-7273), which Zyxel had already patched in June. However, security researchers at Binary later found that the real exploit targeted a previously unknown flaw, which still affected devices even after the June patch. The attackers used a script to collect device configurations, hashed root credentials (passwords stored in a scrambled form), and network information. This data could help attackers map out the network and plan further attacks.
The response
Binary reported the new vulnerability to Zyxel on 29 September. Zyxel released firmware updates for the affected models on 22 October and published an advisory on 3 November. The company recommends that administrators update all GS1900 switches, even those already patched in June, to the latest firmware ending in .3C0.
Is there a fix?
Yes. Zyxel has released updated firmware for all affected GS1900 models. Administrators should apply these updates as soon as possible to close the vulnerability. Devices running the latest firmware ending in .3C0 are protected.
Why it matters
Network switches are a key part of business infrastructure. Attackers who access their configuration and credentials can map out networks and potentially launch further attacks. This incident shows that even recently patched devices can still be vulnerable if a new flaw is discovered.
Key points
- 996 Zyxel GS1900 switches were compromised in 48 countries.
- Attackers exploited a new zero-day flaw, CVE-2026-107441.
- Stolen data included device configurations and hashed root credentials.
- The flaw affected devices even after a previous June security update.
- Zyxel has released a patch; admins should update to firmware ending in .3C0.
Sources
CSO Online
Reference