Zyxel GS1900 Switch Zero-Day Hacked 996 Devices: Install Patch 3

Zyxel has released new firmware for ten models of its popular GS1900 smart switches after researchers found that attackers had a way around a fix the company shipped in June. The flaw, CVE-2026-107441, was used to compromise nearly 1,000 switches worldwide. GS1900 switches are common in small offices, schools, hotels and shops, so if your network cabinet has one, it is worth checking today.

What happened

In June 2026, Zyxel patched an earlier pre-authentication buffer overflow in GS1900 switches, tracked as CVE-2026-7273. From around 17 August, threat intelligence firm GreyNoise saw a suspected Chinese-speaking group exploiting GS1900 devices, and reported 996 compromised switches across 48 countries. When GreyNoise disclosed the campaign on 21 September, it was linked to the June flaw, and CISA added CVE-2026-7273 to its list of known exploited vulnerabilities the same day.

Security firm Binarly then recovered the attackers’ exploit, an obfuscated Python script found in an exposed archive. On 28 September it confirmed that the script still worked against all ten firmware releases that contained the June fix. Binarly reported this to Zyxel on 29 September. Zyxel confirmed the new flaw on 11 October, released fixed firmware on 22 October and published its advisory on 3 November.

How the bypass worked

According to BleepingComputer’s reporting, the June patch added checks to stop oversized data overflowing memory. But the attackers could corrupt a parameter counter before it was checked, overwriting memory and running commands without logging in. Zyxel describes the bug as an out-of-bounds write in the switch’s CGI program, which handles the web management page. The new firmware limits the size of HTTP parameters and validates how many there are before copying data into memory.

Once inside, attackers ran commands and downloaded a script that collected configuration files, hashed root credentials and network information. Researchers linked the activity to a wider campaign that had also exploited a flaw in the Gitea code-hosting software.

Which switches are affected

Zyxel’s advisory lists these models. If your firmware version ends in .2)C0 or earlier, you need the update. The fixed version ends in .3)C0, also referred to as V2.90 Patch 3.

• GS1900-8: fixed in 2.90(AAHH.3)C0
• GS1900-8HP: fixed in 2.90(AAHI.3)C0
• GS1900-10HP: fixed in 2.90(AAZI.3)C0
• GS1900-16: fixed in 2.90(AAHJ.3)C0
• GS1900-24: fixed in 2.90(AAHL.3)C0
• GS1900-24E: fixed in 2.90(AAHK.3)C0
• GS1900-24EP: fixed in 2.90(ABTO.3)C0
• GS1900-24HPv2: fixed in 2.90(ABTP.3)C0
• GS1900-48: fixed in 2.90(AAHN.3)C0
• GS1900-48HPv2: fixed in 2.90(ABTQ.3)C0

Zyxel says products not in its table are not affected. The advisory offers no workaround other than installing the patched firmware.

Who can exploit it

The flaw is rated 8.8 out of 10. An attacker needs network access to the switch’s web management interface but does not need a password. That usually means someone already on your local network, or anyone at all if the management page has been exposed to the internet. A compromised laptop, an unsecured guest Wi-Fi network or a shared building network can all provide that foothold.

Why it matters for small businesses

Switches are the quiet boxes that connect every PC, printer, CCTV camera and access point in an office. Because they rarely need attention, many are installed once and never updated. A hijacked switch gives an attacker a hiding place inside the network that antivirus on staff computers will not see, plus configuration details useful for further attacks.

This case also shows that “we patched in June” is not the end of the story. A fix can be incomplete, and vendors sometimes need several rounds to close a hole properly. Across Nigeria and the rest of Africa, many SMEs buy networking gear through resellers and installers who may not be on contract to maintain it, so nobody is watching for advisories like this one.

What you should do

1. Identify your switches. Check the label on each switch in your network cabinet for the model name. Note any GS1900 models from the list above.
2. Check the firmware version. Sign in to the switch’s web management page and look at the system information or status screen. Compare the version with the fixed release for your model.
3. Download firmware only from Zyxel. Get the update from Zyxel’s official support pages, not from forums or file-sharing sites. Back up the switch configuration before you start.
4. Install during a quiet period. The switch will restart, briefly cutting off everything plugged into it. Do it after hours.
5. Limit access to the management page. Make sure it is never reachable from the internet, and where possible restrict it to a separate management network or a few trusted IP addresses. Keep guest Wi-Fi isolated from it.
6. Change the admin password. Since attackers took hashed credentials from compromised devices, set a new, strong admin password after updating, and review the configuration for changes you did not make.
7. Ask your installer. If a contractor manages your network, ask them to confirm in writing that every GS1900 is on the .3)C0 firmware.

Ten minutes with a laptop and the switch’s web page can close a door that attackers have already shown they know how to open.

Sources

• Zyxel security advisory: out-of-bounds write vulnerability in GS1900 series switches
• BleepingComputer: Zyxel fixes zero-day exploited to hack nearly 1,000 network switches
• CybelAngel: Weekly Cyber Roundup, November 2-8, 2026

Featured image: Photo: “Ethernet Cable” by David Davies, CC BY-SA 2.0, via Openverse — source