Summary Points
- Attackers exploited GS1900 switches in 48 countries, stealing configurations, hashed root credentials, and network data.
- The June patch left the unsafe code in place; all 10 June firmware releases remained vulnerable.
- The flaw enables unauthenticated root-level command execution via the web management service; Zyxel’s October fix is required.
Threat, Attack Techniques, and Targets
- Attackers exploited a flaw in the web management program of Zyxel GS1900 switches. The flaw, CVE 2026 107441, allows an unauthenticated attacker to run operating system commands with root privileges.
- GreyNoise reported attacks against 996 switches in 48 countries. Attackers took switch configurations, hashed root credentials, and networking information.
- Binarly found that the June update did not fix the flaw. Its review showed that all 10 firmware releases described as fixes still contained vulnerable code. The flaw affects ten GS1900 models.
- Zyxel says an attacker must access the local network. However, Binarly says access to the switch’s management service is enough. CISA added the earlier related vulnerability, CVE 2026 7273, to its Known Exploited Vulnerabilities catalog.
Impact, Security Implications, and Remediation
- Because the flaw can allow command execution with root privileges, an attacker may gain extensive control of an affected switch. The reported attacks also exposed configurations, hashed credentials, and network information.
- The June update left vulnerable code in place. Therefore, switches that received only that update still need new firmware.
- Zyxel released a fix on October 22 and advises users to install updates for better protection. For example, GS1900 8 firmware 2.90(AAHH.2)C0 and earlier is affected. Version 2.90(AAHH.3)C0 fixes the flaw.
- Check Zyxel’s advisory for the correct firmware for each affected model, then install the update.
Continue Your Tech Journey
Dive deeper into the world of Cryptocurrency and its impact on global finance.
Discover archived knowledge and digital history on the Internet Archive.
ThreatIntel-V1
