Zyxel published CVE-2026-107441 and patched GS1900 firmware on 3 November. The flaw is an unauthenticated out-of-bounds write in the switch web interface, and the exploit used in real attacks still works on the firmware that was supposed to close the previous hole.
What happened
The bug sits in the switch's CGI program, which handles HTTP POST requests. Each request parameter is copied into a fixed global buffer without a check on its length or on how many parameters arrive. A crafted request corrupts process memory, and the attacker uses that write to redirect execution and run OS commands.
Zyxel scores it CVSS 3.1 at 8.8, attack vector adjacent network, no privileges and no user interaction required. Affected builds are 2.90(AAxx.2)C0 and earlier across ten models: GS1900-8, 8HP, 10HP, 16, 24, 24E, 24EP, 24HPv2, 48 and 48HPv2. Fixed builds are the matching .3 firmware for each model.
Binarly found it while tracking the JITTERLY backdoor, which drops a rootkit called SIXZUT. The malware's command server held an open directory containing an obfuscated exploit labelled as a Zyxel GS1900 pre-auth RCE, which Binarly tested on real hardware. The same exploit ran unchanged against firmware carrying the fix for CVE-2026-7273, the flaw CISA added to its KEV catalog on 21 September after attackers pulled configurations and hashed root credentials from 996 switches in 48 countries.
Who is affected
Any GS1900 on a .2 or earlier build, wherever the web interface can be reached from the local network.
- Offices and branches using GS1900 switches for access or small core duty.
- Sites that were "already patched" in June or September and stopped looking.
- Networks where the switch management address is reachable from staff or guest VLANs rather than a dedicated management segment.
What to do now
Put every GS1900 on the .3 firmware for its exact model, and treat any switch that was reachable before that as suspect.
- Check the model and build in the web interface, then install the matching 2.90(AAxx.3)C0 image from Zyxel. Do not assume the generic download fits a different model letter code.
- Change factory default credentials on every unit; GreyNoise found 564 of the earlier victims still using them.
- Move switch management onto a dedicated VLAN and keep it off guest and staff networks.
- If a switch held SNMP communities, RADIUS secrets or configuration backups, rotate them once the firmware is current.
What this means for South African businesses
Small switches are the least-watched hardware in a South African office: installed once, configured once, and never in the patch cycle. Judgement: the odds of a criminal targeting one specific GS1900 are low, but the same pre-auth access is what a ransomware operator uses to move from a compromised laptop to the rest of the network, and a switch that answers unauthenticated HTTP requests from the staff VLAN is the easiest hop on the list.
Source: Zyxel security advisory, 3 November 2026.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.