// AI threat desk · 15 Nov 2026
Home/CVE · Vulns & Patches
Vulns & PatchesCriticalCVECVSS 9.8 / 8.8

Zyxel GS1900 switch flaw could let attackers run OS commands

Zyxel released Patch 3 for 10 GS1900 switch models; the flaw could let unauthenticated LAN attackers run OS commands, Zyxel said. The Hacker News said the firmware was posted on Oct 23.

· 2 min read
AI-generated image of a technician examining a managed Ethernet switch in a network closet.
AI-generated image, not a photo of the event.
Key takeaways
  • The GS1900 firmware flaw could let a LAN-based, unauthenticated attacker execute OS commands through a crafted HTTP request.
  • The Hacker News said the new 2.90 Patch 3 firmware fixes CVE-2026-107441 and was posted on Oct 23.
  • The Hacker News said switches on Patch 2 or earlier firmware need the Patch 3 build for their model.

Zyxel has released patches for GS1900 series switches affected by an out-of-bounds write vulnerability. The Hacker News said the Patch 3 firmware was posted on Oct 23 and that switches with the earlier fix remained open to the exploit.

The flaw could let a LAN-based, unauthenticated attacker execute operating-system commands through a crafted HTTP request. The Hacker News said researchers rated it 9.8 out of 10 on the CVSS scale, compared with 8.8 in Zyxel’s CVE entry, and said the commands run with root privileges.

The issue affects the switch firmware’s CGI program. The Hacker News said researchers found the exploit on Sep 17 in an open folder on a server that also acted as a JITTERLY command server.

On this page

Researchers describe how Patch 3 fixes the flaw

The Hacker News said the exploit lets anyone who can reach a switch’s web management interface run commands without logging in. The researchers said the commands run with root privileges.

In the Patch 3 code, the counter is checked before a parameter is copied and the copy is limited in size. The researchers said this fixes the flaw, which is tracked as CVE-2026-107441.

Attackers collected data from 996 GS1900 switches

The Hacker News said GreyNoise reported on Sep 21 that attackers took data from 996 GS1900 switches around Aug 17. It said the attackers used the exploit to download a data-collection script onto the switches and left the collected data to be picked up.

The collected data included switch configurations, hashed root credentials and network information. Of the 996 switches, 564 still used factory-default credentials, according to The Hacker News.

Patch 2 was the earlier GS1900 fix

The earlier fix was 2.90 Patch 2 firmware, named in a Jun 16 advisory for CVE-2026-7273. The Hacker News said GS1900 switches that received that fix remained open to the exploit attackers used, based on findings from Binarly.

Owners running Patch 2 or earlier firmware need the Patch 3 build for their model, according to The Hacker News. It said the Patch 3 code checks the counter before copying a parameter and limits the copy size, which researchers said fixes the flaw.

The researchers reported the flaw to Zyxel on Sep 29, when attackers already had a working exploit, according to The Hacker News.

FAQ

Which Zyxel GS1900 firmware fixes CVE-2026-107441?

The Hacker News said the new 2.90 Patch 3 firmware fixes CVE-2026-107441 and was posted on Oct 23.

Are Zyxel GS1900 switches on Patch 2 affected?

The Hacker News said switches on Patch 2 or any earlier firmware need the Patch 3 build for their model.

What could an attacker do through the GS1900 flaw?

The Hacker News said anyone who can reach a switch’s web management interface could run commands without logging in. The researchers said those commands run with root privileges.

What data did attackers take from GS1900 switches?

The Hacker News said the collected data included switch configurations, hashed root credentials and network information. It said GreyNoise reported data taken from 996 switches around Aug 17.

Sources

  1. Zyxel security advisory for out-of-bounds write vulnerability in GS1900 series switches | Zyxel Networks, ZyxelPrimary
  2. Zyxel GS1900 Patch Fails to Block Zero-Day Exploit Allowing Root Command Execution, The Hacker News
  3. Zyxel fixes zero-day exploited to hack nearly 1,000 network switches, BleepingComputer
How we checked this story
ClaimSourceStatus
Zyxel said it released patches for GS1900 series switches affected by an out-of-bounds write vulnerability.ZyxelConfirmed
Zyxel said the vulnerability could let a LAN-based, unauthenticated attacker potentially execute operating-system commands through a crafted HTTP request.ZyxelConfirmed
The Hacker News reported that GS1900 switches with the earlier fix remained open to the exploit attackers used.The Hacker NewsAttributed
The Hacker News said the exploit lets anyone who can reach a switch’s web management interface run commands without logging in.The Hacker NewsAttributed
The Hacker News said zyxel released new firmware for 10 GS1900 models that closes the hole.The Hacker NewsAttributed
The Hacker News said the earlier fix was 2.90 Patch 2 firmware, named in a June 16 advisory for CVE-2026-7273.The Hacker NewsAttributed
The Hacker News said the new 2.90 Patch 3 firmware fixes CVE-2026-107441, and it was posted on October 23.The Hacker NewsAttributed
The Hacker News said binarly reported the flaw to Zyxel on September 29, when attackers already had a working exploit.The Hacker NewsAttributed
The Hacker News said greyNoise reported on September 21 that attackers took data from 996 GS1900 switches around August 17.The Hacker NewsAttributed
The Hacker News said binarly rated the flaw 9.8 out of 10 on the CVSS severity scale, compared with 8.8 in Zyxel’s CVE entry.The Hacker NewsAttributed
The Hacker News said the researchers said the attacker’s commands run with root privileges.The Hacker NewsAttributed
The Hacker News said owners on Patch 2 or earlier firmware need the Patch 3 build for their model.The Hacker NewsAttributed
The Hacker News said greyNoise said attackers used the exploit to download a data-collection script onto switches and left the collected data to be picked up.The Hacker NewsAttributed
The Hacker News said the collected data included switch configurations, hashed root credentials, and network information.The Hacker NewsAttributed
The Hacker News said of the 996 switches, 564 still used factory-default credentials.The Hacker NewsAttributed
The Hacker News said the researchers found the exploit on September 17 in an open folder on a server that also acted as a JITTERLY command server.The Hacker NewsAttributed
The Hacker News said the Patch 3 code checks the counter before copying a parameter and limits the copy size, which the researchers said fixes the flaw.The Hacker NewsAttributed

Could not verify

  • Whether the new CVE-2026-107441 flaw was exploited in the wild is not established.
  • Whether the attacked switches were running Patch 2 is not established.
  • How many switches were compromised rather than scanned or accessed is not established.
  • Whether updating removes access an attacker may already have is not established.
cve
See all in Vulns & Patches →
Explore with AI
ChatGPT
Claude
Perplexity
Grok