Zyxel GS1900 zero-day: the June patch didn't stop the hacks

In September we told you to patch your Zyxel GS1900 switches. That patch wouldn't have saved you. Nearly 1,000 GS1900 switches were hacked in August, and the attacks were blamed on CVE-2026-7273, a bug Zyxel fixed in June. Security firm Binarly now says the attackers used a different, unknown bug: a zero-day, now CVE-2026-107441. Switches with the June firmware were still open. The real fix is the 2.90 Patch 3 firmware Zyxel shipped in late October.

What actually happened

Zyxel published its CVE-2026-107441 advisory on November 3:

• The bug. An out-of-bounds write in the switch's CGI program could let "a LAN-based, unauthenticated attacker" run OS commands with a crafted HTTP request.
• Affected. Ten models, GS1900-8 through GS1900-48HPv2, on 2.90 Patch 2 or earlier.
• Fixed. Model-specific 2.90 Patch 3 firmware, for example 2.90(AAHL.3)C0 on the GS1900-24.
• Credit. Yegor Vasilenko and Fernando Mercês of Binarly.

SecurityWeek reports the background. GreyNoise had tied the August attacks to CVE-2026-7273 and to a Chinese group called Red Heron, and CISA added that bug to its KEV catalog. Binarly found that the attackers used the same malware but a different exploit. "The patch for CVE-2026-7273 remained ineffective," Binarly said. It told Zyxel on September 29. Zyxel confirmed the new bug two weeks later, shipped fixes on October 23, and published the advisory November 3. SecurityWeek lists its CVSS score as 8.8.

We covered the first round in our September post. That advice wasn't wrong. It just wasn't enough.

Why the Zyxel GS1900 zero-day matters for your business

GS1900s are cheap managed switches. They sit in a lot of small-business network closets, often installed once and never touched. Here's the order of work:

1. Find every GS1900. Check the model and firmware on the web admin page.
2. Install 2.90 Patch 3 for your exact model from Zyxel's advisory table.
3. Assume compromise if it was exposed. If the admin page was reachable from guest Wi-Fi or the internet over the summer, factory-reset the switch, then patch it, then set a new admin password.
4. Put the admin page on a management VLAN. The bug needs network access to the web interface. Take that away.

The bigger lesson: "we patched it" means "we patched the bug we knew about." When an attack is blamed on an old bug, the patch for that bug only protects you if the blame is right. Limit who can reach the admin interface, and the next misattribution won't matter as much.

Sources: Zyxel security advisory, SecurityWeek.