Affected Systems

Zyxel GS1900 network switches (10 models: GS1900-8, -8HP, -10HP, -16, -24, -24E, -24EP, -24HPv2, -48, -48HPv2) running firmware 2.90 Patch 2 or earlier. The original CVE-2026-7273 patch (Patch 2) failed to block exploitation. New vulnerability CVE-2026-107441 enables the same attack vector.

Exploitation Status

Actively exploited in the wild. GreyNoise observed attacks on 996 GS1900 switches around August 17, 2024, with data exfiltration. Binarly researchers found a working exploit on a command-and-control server linked to Chinese-speaking threat actor Red Heron. The exploit works unchanged against Patch 2 firmware. Binarly plans to release a proof-of-concept soon.

Business Impact

Unauthenticated remote attackers with network access to the web management interface can execute arbitrary commands with root privileges via an out-of-bounds write vulnerability. Attackers have exfiltrated switch configurations, hashed root credentials, and network information from compromised devices. 564 of 996 attacked switches used default credentials. Organizations with GS1900 switches on internet-facing or untrusted networks face immediate compromise risk. The vulnerability allows full device takeover without authentication.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately upgrade all Zyxel GS1900 switches to firmware 2.90 Patch 3 (model-specific builds available at Zyxel support site). Patch 2 does NOT protect against exploitation.
  • Isolate GS1900 switch management interfaces from untrusted networks. Restrict web interface access to dedicated management VLANs with strict ACLs until patching is complete.
  • Change default credentials on all GS1900 switches immediately. Audit for factory-default passwords (admin/1234) which were present on 56% of compromised devices.
  • Review switch configurations and logs for unauthorized changes or data exfiltration between August 17 and present. Check for unexpected outbound connections or downloaded scripts.
  • Monitor for CVE-2026-107441 addition to CISA KEV catalog and prepare for federal compliance deadlines if applicable. CVE-2026-7273 is already on KEV with 3-day remediation requirement.