Zyxel Switch Fix Falls Short: Patched GS1900 Models Still Open to Attack Without a Login

Zyxel GS1900 network switches that received the vendor's earlier fix for an actively exploited flaw can still be attacked, according to researchers at Binarly. The exploit lets anyone who can reach a switch's web management interface run commands on it without logging in. The researchers say those commands run with root privileges, and they rate the flaw 9.8 out of 10 for severity, compared with 8.8 in the vendor's own entry.

The earlier fix was the 2.90 Patch 2 firmware, named in a June 16 advisory for CVE-2026-7273. Zyxel has now released 2.90 Patch 3 for 10 GS1900 models, which fixes a separately tracked flaw, CVE-2026-107441, that the exploit relies on. Binarly reported it to the vendor on September 29 and calls it a zero-day, because attackers already had a working exploit. GreyNoise reported on September 21 that attackers took data from 996 GS1900 switches around August 17, and the researchers say the exploit it described matches theirs. Neither group says the attacked switches were running the earlier fix, and the vendor does not say whether the new flaw has been exploited.

Switches on Patch 2 or any earlier firmware need the Patch 3 build for their model. The advisory lists no workaround for owners who cannot update yet. It also does not say whether updating removes access an attacker may already have, or what to check if a switch may have been compromised.