Zyxel patches a zero-day hiding behind an old fix

Zyxel has released firmware updates that patch a zero-day CVE-2026-107441, an out-of-bounds write flaw in the web management interface of its GS1900 switches. The CVSS 8.8 vulnerability lets unauthenticated network attackers execute operating system commands via crafted HTTP requests. It affected ten GS1900 models, including GS1900-8, GS1900-24 and GS1900-48, with firmware versions ending in .2C0 marked vulnerable and fixes in versions ending in .3C0. GreyNoise reported the attack began around August 17 and compromised 996 switches in 48 countries, stealing device configurations, network information and hashed root credentials. Researchers initially blamed CVE-2026-7273, a June-released buffer overflow fix, but Binary discovered an exploit that worked even on switches with the June updates. Zyxel’s advisory was published on November 3 and the updates issued on October 22. ¹