Zyxel GS1900 Vulnerability: Install Patch 3 Now to Stop Root Attacks

The Zyxel GS1900 vulnerability tracked as CVE-2026-107441 lets an attacker who can reach the switch’s web management page run commands as root without logging in. Zyxel has fixed it in firmware V2.90 Patch 3, and every owner of a GS1900 switch should install that update now, because the earlier Patch 2 did not fully close the hole.

The GS1900 is a popular smart-managed switch in small offices, shops, schools and home labs across India, so this is one of those quiet network-gear flaws that is easy to miss and costly to ignore.

Quick summary

• What: Out-of-bounds write in the switch’s web (CGI) program, CVE-2026-107441.
• Impact: An unauthenticated attacker on the network can potentially run operating-system commands on the switch.
• Affected: 10 GS1900 models on firmware 2.90 Patch 2 and earlier.
• Fix: Firmware V2.90 Patch 3 (the “.3)C0” builds), listed in Zyxel’s advisory of 3 November 2026.
• Workaround: Zyxel lists none. Until you patch, keep the management page off untrusted networks.

What is the Zyxel GS1900 vulnerability?

It is a memory-safety bug in the program that handles requests to the switch’s web interface. Zyxel’s advisory says a LAN-based, unauthenticated attacker could potentially execute OS commands by sending a crafted HTTP request. Binarly, the security firm that reported it, rates the flaw 9.8 out of 10 on the CVSS scale and says commands would run with root privileges.

Also read: Crafty Falcon: CERT-In Warns Fintechs of AI-Driven Payment API Attacks

In simple terms, the switch reserves space for a fixed number of request parameters but does not check the input properly before copying it. A specially built request can spill past that space and change what the program does next. No password is needed; the attacker only needs to reach the management service over the network.

Why the earlier patch was not enough

This flaw matters more because of what came before it. In September 2026, attacks on GS1900 switches were linked to an earlier bug, CVE-2026-7273, which Zyxel had fixed in firmware 2.90 Patch 2. Security researchers reportedly later found that the exploit used in those attacks still worked against Patch 2, because the size check happened after the data was already copied. Patch 3 moves the check before the copy and limits how much is copied.

So if you updated your switch in September and assumed you were safe, you need to update again. Reports of the earlier campaign said attackers took switch configurations and hashed admin credentials, and that many affected switches still used factory-default passwords. Treat those figures as reported by researchers; Zyxel’s own advisory does not say whether CVE-2026-107441 has been exploited.

Affected GS1900 models and fixed firmware

Zyxel lists ten models that are still within their vulnerability support period. Check the model label on your switch and its current firmware under the dashboard or system information page, then compare it with this table.

Model	Affected firmware	Fixed firmware (Patch 3)
GS1900-8	2.90(AAHH.2)C0 and earlier	2.90(AAHH.3)C0
GS1900-8HP	2.90(AAHI.2)C0 and earlier	2.90(AAHI.3)C0
GS1900-10HP	2.90(AAZI.2)C0 and earlier	2.90(AAZI.3)C0
GS1900-16	2.90(AAHJ.2)C0 and earlier	2.90(AAHJ.3)C0
GS1900-24	2.90(AAHL.2)C0 and earlier	2.90(AAHL.3)C0
GS1900-24E	2.90(AAHK.2)C0 and earlier	2.90(AAHK.3)C0
GS1900-24EP	2.90(ABTO.2)C0 and earlier	2.90(ABTO.3)C0
GS1900-24HPv2	2.90(ABTP.2)C0 and earlier	2.90(ABTP.3)C0
GS1900-48	2.90(AAHN.2)C0 and earlier	2.90(AAHN.3)C0
GS1900-48HPv2	2.90(ABTQ.2)C0 and earlier	2.90(ABTQ.3)C0

Models not in this list are not affected, according to Zyxel. Older GS1900 units that are past their support period are not covered by the advisory at all, which is a good reason to plan a replacement for them.

How to update a GS1900 switch to Patch 3

Zyxel says the firmware transfer alone can take 5 to 15 minutes per switch, followed by an automatic reboot. Do it during a quiet hour, because the network ports drop while the switch restarts.

1. Find the right file. Open Zyxel’s V2.90 Patch 3 release note on the Zyxel Community (linked in Sources) and download the .zip for your exact model. The build code must match, for example AAHL for the GS1900-24.
2. Back up the configuration. Log in to the switch’s web interface and save the current configuration to your computer before changing anything.
3. Open the firmware page. Go to Maintenance > Firmware, choose the extracted firmware file and start the upgrade. Zyxel also offers its ZON (Zyxel One Network) utility as an alternative.
4. Do not interrupt it. Zyxel says the transfer can take 5 to 15 minutes and the switch reboots on its own. Never switch off power during this time.
5. Confirm the version. After the reboot, check that the firmware now ends in “.3)C0”.

If your switch runs a much older release such as V2.20, Zyxel’s community guide says you can upgrade directly to V2.90, but the old web page may not display correctly in modern browsers. In that case, the ZON utility is the easier route.

Extra steps after patching

Patching closes the hole, but it does not undo anything an attacker may already have done. Because the earlier campaign reportedly took configurations and password hashes, these follow-up steps are worth the extra ten minutes.

• Change the admin password to a long, unique one, especially if it was still the factory default.
• Restrict management access to a dedicated admin VLAN or a few trusted IP addresses. Never expose the web interface to the internet.
• Review the configuration for accounts, VLANs or settings you did not create.
• Check other network gear such as routers, firewalls and NAS boxes for pending firmware updates. Our guide to the Synology NAS ransomware attacks shows how the same pattern plays out on storage devices.
• Keep an inventory of every switch and its firmware version, so the next advisory takes minutes, not days.

For businesses without in-house IT staff, routine firmware checks are often the first thing to slip. A managed IT service can take over patch tracking for switches, firewalls and servers.

Who should worry most?

The risk is highest where the switch’s web page can be reached by many people or devices: offices with flat networks, guest Wi-Fi on the same network, schools and co-working spaces. It also applies to any switch whose management page was forwarded to the internet for remote access. A home lab with a single trusted user is lower risk, but it should still be patched.

If you also run Linux servers, see our guide to the SSHole OpenSSH flaw on Alpine servers, and our Android November security update guide for phones.

Frequently asked questions

Is my Zyxel GS1900 switch affected by CVE-2026-107441?

It is affected if it is one of the ten listed models and runs firmware 2.90 Patch 2 or earlier. Builds ending in “.3)C0” are patched.

I installed Patch 2 in September. Am I safe?

No. Patch 2 fixed CVE-2026-7273 but not CVE-2026-107441. You need V2.90 Patch 3.

Is there a workaround if I cannot update right away?

Zyxel lists no official workaround. Limiting who can reach the management web page reduces exposure, but it is not a substitute for the firmware update.

Does the update erase my switch settings?

Zyxel’s notes do not say it does, but back up the configuration first so you can restore it if anything goes wrong.

Bottom line

If you own a GS1900 switch, check its firmware today and install V2.90 Patch 3. Then change the admin password and lock the management page to trusted devices. A ten-minute job now is far cheaper than cleaning up a compromised network later.

Sources

• Zyxel security advisory for out-of-bounds write vulnerability in GS1900 series switches
• Zyxel Community: GS1900 series V2.90 Patch 3 firmware release
• Binarly advisory BRLY-2026-057
• Zyxel Community: GS1900 firmware upgrade guide

About The Author