Zyxel patches flaw in 10 GS1900 switch models

Zyxel has released firmware updates for 10 GS1900 network-switch models to fix a vulnerability that Binarly researchers say remained exploitable after an earlier security patch. The flaw, tracked as CVE-2026-107441, can allow an unauthenticated attacker with network access to execute commands through a switch’s web management interface. GreyNoise reported that attackers compromised 996 GS1900 switches across 48 countries, beginning around August 17, and collected device configurations, hashed root credentials and network information. Its report linked the activity to an exploit that Binarly later found could work on firmware updated to address an earlier vulnerability, CVE-2026-7273. The reports do not establish which firmware versions the compromised switches were running or whether the attackers exploited CVE-2026-107441 specifically. GreyNoise’s account of the compromised devices and collected data derives from its attack-traffic analysis; the reports do not provide independent confirmation of those underlying compromises. Binarly said the earlier Patch 2 update checked a parameter counter only after copying a request parameter into memory. An oversized parameter could...