Patch Zyxel GS1900 switches: unauthenticated flaw under reported attack

Published 9 November 2026 by oowl. General information for Australian small businesses, not advice for any particular organisation.

What happened

On 3 November 2026 Zyxel published a security advisory for CVE-2026-107441, an out-of-bounds write flaw in the web management interface of its GS1900 series smart switches. Zyxel's advisory says that a LAN-based attacker who needs no login could potentially run operating system commands on the switch by sending a crafted HTTP request. The Zyxel advisory lists fixed firmware for ten models.

The flaw is also being used in attacks. BleepingComputer reports that GreyNoise counted 996 compromised devices across 48 countries, with exploitation starting around mid-August. In those attacks, the intruders downloaded a script that collected device configurations, hashed root credentials and network details. Zyxel's advisory does not mention exploitation, so that part comes from the research reported in the news story.

Who is affected

Businesses that run one of the ten GS1900 models with firmware at or below the affected builds. Zyxel says products not listed in its table are unaffected. These switches are often installed once and rarely looked at again, so the owner may not know which model is in the comms cupboard or that its web page can be reached from outside the office.

The risk is mainly to the office network rather than to a single computer. A compromised switch sits between every device on the network, and the attackers' script went after the configuration and the credentials stored on it.

What to do

1. Find the model. Check the label on each switch, or the model shown on its login page, and note the firmware version.
2. Compare with the table. Zyxel's advisory lists the affected and fixed builds for each model. For example, a GS1900-8 running 2.90(AAHH.2)C0 or earlier is affected, and 2.90(AAHH.3)C0 is the fixed build.
3. Install the fixed firmware for each affected switch. The advisory lists no workaround, so patching is the only fix it describes. An earlier June update for a different flaw does not cover this one, according to the BleepingComputer report.
4. Limit who can reach the switch's web page. The advisory does not say to do this, but it reduces exposure. Check router port forwards and firewall rules for any rule that sends outside traffic to the switch's management address.
5. Change the switch passwords after patching, including the admin login, because the attacks targeted stored credentials.
6. Ask your IT provider to check for changes. If a switch was reachable from the internet while unpatched, ask them to review its configuration and logs and to look at the rest of the network for unexpected accounts or devices. If you find signs of compromise, report it through ReportCyber at cyber.gov.au.

Patching network devices is part of keeping the basics in place. Our Essential Eight page sets out how we approach patching more broadly.

Sources

• Zyxel Security Advisory for Out-of-Bounds Write Vulnerability in GS1900 Series Switches, Zyxel
• Zyxel fixes zero-day exploited to hack nearly 1,000 network switches, BleepingComputer

oowl writes each brief in its own words from the public sources listed. Check the sources for the latest detail, because advisories are often updated after publication. More briefs: all threat briefs or the Atom feed.