Network equipment manufacturer Zyxel warned November 3, 2026 that ten GS1900 managed-switch models require new firmware for CVE-2026-107441, a memory-corruption flaw that can permit unauthenticated operating-system command execution through a web management interface. Independent firmware researchers discovered that a recovered exploit worked against Patch 2 firmware meant to fix an earlier weakness. Zyxel’s newer Patch 3 addresses the additional flaw.

GS1900 switches connect Ethernet devices within offices, schools and small-business networks. Their web interface configures virtual LANs, port settings and other controls. A vulnerable management plane can expose configuration data and credentials even while ordinary packet forwarding continues.

Why the June firmware was not enough

On June 16, Zyxel issued a fix for CVE-2026-7273, a stack-based buffer overflow in the same switch family. During later research, Binarly recovered an obfuscated Python attack program from infrastructure connected to an intrusion campaign. Its researchers tested the recovered program against the ten Patch 2 firmware versions and found it could still execute commands without authentication.

The remaining flaw was in the web-management CGI program’s handling of request parameters. Earlier protection did not fully prevent an out-of-bounds memory write. The updated code checks parameter size and count before copying data. Zyxel classified the issue separately as CVE-2026-107441 and made 2.90(XXXX.3)C0 firmware available for the ten listed models, with the four-letter identifier varying by hardware model.

The 996-switch attack and attribution limits

GreyNoise documented theft of switch configurations, network details and hashed root credentials from 996 GS1900 devices across 48 countries around August 17. The threat-intelligence company originally connected the activity to the older vulnerability, CVE-2026-7273. Binarly later demonstrated that the recovered exploit also worked against firmware carrying the June fix.

Neither report establishes the installed firmware versions of each of the 996 affected devices. Consequently, the new CVE cannot be conclusively identified as the specific weakness exploited on every victim. CISA’s Known Exploited Vulnerabilities record covers the earlier CVE, but a government catalog entry and successful testing of a vendor fix represent different kinds of evidence.

Patch 3 and management isolation are the immediate safeguards

Zyxel lists affected GS1900-8, -16, -24 and -48 models alongside PoE variants; the vendor advisory identifies all ten model-specific release numbers. Administrators should inventory installed firmware, back up configurations, download the correct image directly from Zyxel, install it, and confirm the active firmware after the required restart. Web administration should be limited to a dedicated management network with restrictive access controls.

Where compromise is suspected, responders should examine administrative logins, changed VLANs or port mirroring, SNMP configuration, connected identity systems and accounts. Replacing stolen credentials and investigating neighboring systems may be necessary; merely rebooting cannot undo exfiltration. Earlier BitcoinVersus.Tech lessons explain firmware update security and Layer 2 switch defenses.

Additional techniques such as 802.1X port authentication and MACsec link encryption can support layered network security but do not repair the vulnerable management program. The central lesson is operational: installing a patch and confirming protection against the exploit are separate verification steps. The next action is to validate Patch 3 on every supported GS1900 unit and assess possible exposure during the August campaign.

We volunteer daily to ensure the information on this platform is Verifiably True. If you would like to support the research, please scan QR code.

Donate 5,000 sats. To scan on mobile, open the article on another screen and use a compatible Bitcoin wallet to scan the original QR code. Verify the destination 3C9o19EH5HSiwEPyCTmEKzxhNCbo2X6TTb before sending.

Editor’s Note: Zyxel’s November 3 disclosure, Binarly’s direct technical findings, GreyNoise’s attack observations, and independent security reporting support the article. The 996 affected devices were counted during the August campaign; their individual firmware versions remain unconfirmed. The two official Zyxel training videos are historical, not footage of the exploit. The cover and flow diagram are original conceptual illustrations, not documentary photographs. BitcoinVersus.tech is not a financial advisor. This media platform reports on financial subjects purely for informational purposes.