Zyxel GS1900 Switches: Why the June Update Isn't Enough

If your office network uses Zyxel GS1900 series switches, they need a firmware update, even if someone already updated them earlier this year. On November 3, 2026, Zyxel published a security advisory for a flaw tracked as CVE-2026-107441, and the fixed firmware has been available since October 22.

What makes this one worth your attention is the backstory. Starting around August 17, attackers compromised 996 of these switches across 48 countries, according to the security company GreyNoise. At the time, the attacks were blamed on an older flaw, CVE-2026-7273, which Zyxel had fixed in June. Researchers at the firmware security company Binarly later found that the attackers' tool actually used a different, previously unknown flaw, and that it still worked on switches running the June update.

The short version: if you have a GS1900 switch, update it to the new 2.90 Patch 3 firmware for your model. Having installed the June update does not protect you from this one.

What the flaw does

According to Zyxel's advisory, the flaw is in the switch's web management program. It could let an attacker who can reach the switch over the network run commands on it with a specially crafted web request, without logging in. BleepingComputer reports that in the attacks, the intruders downloaded a script that collected switch configurations, hashed administrator passwords and information about the network.

Who is at risk

These ten models are affected when running firmware 2.90 (.2)C0 or earlier. The fixed versions end in (.3)C0:

• GS1900-8, GS1900-8HP and GS1900-10HP
• GS1900-16, GS1900-24, GS1900-24E, GS1900-24EP and GS1900-24HPv2
• GS1900-48 and GS1900-48HPv2

Zyxel says on-market products not listed in its advisory are not affected. The risk is highest for a switch whose management page can be reached from the internet or from a guest or untrusted network.

What to do this week

1. Find your GS1900 switches. Check the model and current firmware version on each one.
2. Update the firmware. Install the 2.90 (.3)C0 version listed for your model in Zyxel's advisory, even if the switch already got the June update.
3. Keep the management page private. Make sure the switch's web management page cannot be reached from the internet or guest Wi-Fi.
4. If a switch may have been exposed, assume its details were copied. Change the switch's administrator password and review its configuration for changes you don't recognize.

Questions to ask your IT provider

1. Do we have any Zyxel GS1900 switches, and which firmware are they running?
2. Have they been updated to the 2.90 (.3)C0 firmware, not just the June release?
3. Can anyone reach the switch management pages from the internet or our guest network?
4. If a switch was exposed, have we changed its password and checked its settings?