syslog.eu
CS EN DE FR
[CRIT · FIX TODAY]/News·

Zyxel GS1900 switches: an exploit used in attacks gets past the June patch – update to .3C0

Zyxel published an advisory on November 3 for an out-of-bounds write (CVE-2026-107441) in the web management of ten GS1900 switch models; fixed firmware has been available since October 22. Binarly researchers found that an exploit used by attackers still works against switches that installed Zyxel's June fix. GreyNoise reported that around August 17, attackers took data from 996 GS1900 switches in 48 countries.

Affected gs1900 zyxel
Syslog card, level CRIT (fix today): 996 switches raided, Zyxel GS1900 in August, says GreyNoise. Affected: Zyxel, GS1900 switches. To do: Update to .3C0, even if patched in June; Limit who can reach the switch admin page.

Does this concern you?

  • Affected: GS1900-8, -8HP, -10HP, -16, -24, -24E, -24EP, -24HPv2, -48 and -48HPv2 on firmware ending in .2C0 or earlier.
  • Skip it if: no GS1900 runs in your network. Zyxel patched only models still in support and says unlisted on-market products are not affected; an older, unlisted GS1900 gets no fix.

What to do

  • Today: install the firmware for your model ending in .3C0 (2.90 Patch 3), for example 2.90(AAHL.3)C0 for the GS1900-24.
  • Until then: Zyxel lists no workaround. The exploit needs to reach the switch's web management, so in our view only administrators' computers should be able to open it. For an older GS1900 without a fix, keep it that way for good.
  • The advisory does not say whether updating removes access an attacker already has, or what to check. If a switch's web management was reachable from outside your admin network since mid-August, we would treat its configuration and root credentials as exposed: after the update, change the admin password and any credentials stored in the configuration.
  • Replace factory-default credentials: 564 of the 996 raided switches still had them.

What we know – and what we don't

  • GreyNoise says the attackers downloaded a data-collection script and took configurations, hashed root credentials and network information.
  • GreyNoise tied the August attacks to the June flaw, CVE-2026-7273, which CISA added to its catalogue of exploited flaws on September 21. Binarly says the exploit GreyNoise described matches the one it found and works unchanged against the June fix; it plans to publish a proof of concept soon.
  • Whether the new flaw itself was exploited is disputed: CSO Online calls it a zero-day used against the 996 switches; LavX News (from The Hacker News) notes that neither GreyNoise nor Binarly says the attacked switches ran the June fix. CISA's record for the new CVE (Nov 3) lists no known exploitation.
  • Zyxel scores the flaw 8.8 and speaks of a "LAN-based" attacker; Binarly scores it 9.8 and says any network access to the management service is enough.
  • GreyNoise's report does not say how the attackers reached the switches or which firmware they ran.

Why it matters

Switches rarely get a second look once patched, and their admin page often sits on the same network as everyone's laptops. A configuration and password hashes are a map of your network. If you ticked this off in June, it is still open.

Sources

← All news