Zyxel GS1900 Zero-Day Bypasses Earlier Security Patch, Enabling Root Command Execution

A newly identified zero-day vulnerability in Zyxel GS1900 series network switches allows unauthenticated attackers with access to the web management interface to execute operating system commands with root privileges.

Researchers at Binarly discovered that the exploit remains effective even on devices running an earlier security update released by Zyxel. The vulnerability, tracked as CVE-2026-107441, has a CVSS severity score of 8.8 according to the vendor.

Earlier Security Patch Failed to Block the Exploit

Zyxel released firmware version 2.90 Patch 2 in June 2026 to address an earlier vulnerability, CVE-2026-7273.

However, Binarly researchers found that the previous patch did not adequately validate HTTP request parameter sizes. Attackers could exploit this weakness to overwrite memory and manipulate program execution, allowing malicious commands to run without authentication.

The researchers reported the issue to Zyxel on September 29. The vendor classified it as a separate vulnerability.

Nearly 1,000 Switches Compromised

According to GreyNoise, attackers compromised 996 Zyxel GS1900 switches across multiple countries during an attack campaign beginning around August 17.

The attackers deployed a data-collection script to gather:

Switch configuration files
Hashed root credentials
Network information

GreyNoise also reported that 564 of the compromised switches were still using factory-default credentials.

The activity has been associated with a threat group tracked as Red Heron, although the precise attribution remains uncertain.

Zyxel Releases Patch 3 Firmware

Zyxel has released 2.90 Patch 3 firmware for ten affected GS1900 models to address CVE-2026-107441.

The affected models include:

GS1900-8
GS1900-8HP
GS1900-10HP
GS1900-16
GS1900-24
GS1900-24E
GS1900-24EP
GS1900-24HPv2
GS1900-48
GS1900-48HPv2

Administrators should install the corresponding Patch 3 firmware for their specific switch model. Devices running Patch 2 or earlier versions remain vulnerable.