What Happened
The Zyxel GS1900 vulnerability is not what it first looked like. Researchers at Binarly found that switches that received Zyxel's earlier fix, version 2.90, are still open to the exploit attackers used. The exploit lets anyone who can reach a switch's web management interface run commands on it without logging in. For an MSP, that means a compromised switch can become a foothold in a client network, and the cleanup lands on your team.
Zyxel has released new firmware for 10 GS1900 models that closes the hole. That update is the action that matters. If you manage any GS1900 switch, your next step is to find those switches, confirm the current firmware, and apply the new release. Until then, treat every GS1900 switch as exposed.
This is not a theoretical risk. The vulnerability is being exploited in the wild, according to the reports. The earlier patch was supposed to stop it, and it did not. That is why the new firmware is the only fix. Do not wait for a client to report odd behavior. Check your inventory now.
Timeline
No timeline has been published yet.
Who Is Affected
Any organization running a Zyxel GS1900 network switch that received the earlier 2.90 fix is affected. The new firmware covers 10 GS1900 models, so if you have a GS1900 switch in your managed base, check whether it is on the list.
The attack vector is the web management interface. Any switch that is reachable over the network from an untrusted host is at risk. In practice, that means switches that are exposed to the internet or to parts of the network that are not strictly controlled. MSPs often manage these switches for small and mid-sized clients, so the exposure is direct.
If you are not sure whether a switch received the earlier fix, verify the firmware version before assuming it is safe. The source reports say the earlier fix is the 2.90, so any switch running that version should be considered vulnerable until the new firmware is installed.
Why This Matters for MSPs
A switch sits at the edge of a client network. It is not a server, so it often gets less attention than the firewalls and endpoints you monitor. But a switch with command execution is a reliable foothold. An attacker who owns the switch can observe traffic, redirect it, or use the switch as a launch point to reach other devices.
For an MSP, the cost of this kind of compromise goes beyond the hardware. You lose billable hours to incident response, you explain to the client why a known vulnerability was not fixed, and you risk the account entirely. The fix here is straightforward: confirm the firmware and update it. The longer a switch runs 2.90, the more exposure you carry.
Technical Details
CVE-2026-107441 is an out-of-bounds write flaw. It could allow attackers to execute OS commands via crafted HTTP requests. The exploit lets anyone who can reach a switch's web management interface run commands on it without logging in.
The affected product is the Zyxel GS1900 network switch. The earlier fix is version 2.90. Zyxel has released new firmware for 10 GS1900 models that closes the hole.
Zyxel GS1900 Vulnerability: What MSPs Should Do
Treat every GS1900 switch as exposed until you confirm the new firmware is installed. Work through these steps now.
After you update, verify the new firmware version on each switch and record it in your documentation. If you cannot update a switch right away, put it behind a firewall rule that blocks external access to the management interface. Also, in general, disable the web management interface on switches that do not need it, or bind it to a dedicated management VLAN. These are standard hardening steps that reduce the attack surface for this class of vulnerability.
- Inventory every Zyxel GS1900 switch in your managed base, including ones at client sites.
- Check the current firmware version on each switch.
- Identify which of the 10 affected models you have and download the new firmware from Zyxel.
- Apply the new firmware to every affected switch as soon as possible.
- Restrict access to the web management interface to trusted networks or IP addresses, as a standing practice.
- Review switch logs for signs of unauthorized commands or unusual HTTP requests.
- If you see suspicious activity, isolate the switch and investigate before restoring service.
How EnterProtect Helps
EnterProtect backup keeps clean restorable copies of your clients' systems. If a switch is compromised and an attacker moves sideways, recovery gets a client running again from a known good state.
EnterProtect vulnerability scanning finds exposed versions across your managed environment. That helps you spot firmware that needs updating before it becomes a problem. It gives you visibility into the versions you are running, so you can plan updates and close gaps.
Frequently Asked Questions
What Is CVE-2026-107441?
CVE-2026-107441 is an out-of-bounds write vulnerability in Zyxel GS1900 network switches. It could allow an attacker to execute OS commands via crafted HTTP requests. The exploit does not require authentication if the attacker can reach the web management interface.
Which Zyxel Switches Are Affected?
Zyxel GS1900 network switches that received the earlier 2.90 fix are affected. Zyxel has released new firmware for 10 GS1900 models to close the hole. Check your firmware version against the new release.
How Do I Know If My GS1900 Switch Is Vulnerable?
If your switch is running firmware version 2.90, it should be considered vulnerable. Check for the new firmware Zyxel released for the 10 affected models and apply it.
Can the Exploit Be Used Without Credentials?
Yes, according to the reports. The exploit lets anyone who can reach the switch's web management interface run commands on it without logging in.
What Should I Do If I Cannot Update the Firmware Immediately?
If you cannot update right away, restrict access to the web management interface to trusted networks and IP addresses. Monitor the switch logs for unusual HTTP requests and isolate the switch if you see suspicious activity.
Is This Vulnerability Being Actively Exploited?
Yes, the source reports say it is an actively exploited flaw. Zyxel's earlier fix, version 2.90, did not stop the exploit, which is why the new firmware is critical.
Sources
- Zyxel GS1900 Patch Fails to Block Zero-Day Exploit Allowing Root Command Execution (Hackernews)
- Zyxel Switch Hacks Blamed on Patched Flaw Actually Exploited a Zero-Day (Securityweek)