Zyxel GS1900 switches: local attackers can run commands, and the June patch is…

What happened

On June 16, 2026, Zyxel disclosed CVE-2026-7273, a flaw in its GS1900 series of managed switches. The bug sits in the program that handles the switch’s web management interface. According to Zyxel, an attacker on the local network can exploit it without logging in and potentially run operating system commands on the switch by sending a crafted HTTP request. The fix shipped in firmware 2.90 Patch 2.

The US agency CISA added CVE-2026-7273 to its catalog of exploited vulnerabilities on September 21, 2026, and the European EUVD database has listed it as exploited since the same day. According to Help Net Security, GreyNoise found that a Chinese-speaking threat actor used it to compromise nearly 1,000 devices in 48 countries, stealing their configuration, network information and hashed admin credentials.

Security firm Binarly was investigating the command and control server of malware tied to the same attacker. It found a ready-made exploit there and, in testing, discovered that it also works on switches that already had the June fix. Help Net Security concludes that the attackers apparently were not relying only on CVE-2026-7273, and possibly not at all. Binarly notified Zyxel on September 29, 2026, and Zyxel fixed the second flaw, CVE-2026-107441, in firmware 2.90 Patch 3. Help Net Security reports the fix was released on October 22, 2026, and Zyxel published its official advisory on November 3, 2026.

Neither CISA nor EUVD lists CVE-2026-107441 as exploited yet. But Help Net Security, based on Binarly’s findings, writes that the exploit found on the attackers’ server relies on exactly this flaw. Treat it as seriously as the first one.

Why it is dangerous

Both flaws are memory handling bugs: a stack-based buffer overflow (CVE-2026-7273) and an out-of-bounds write (CVE-2026-107441). Picture a form with a ten-character field where the program never checks whether someone types a hundred. The extra characters spill over into neighboring memory, and a skilled attacker can use that to change what the program does next. Both bugs are in the CGI program, the part of the web management interface that processes requests from the browser.

The attacker does not need to log in, and nobody has to open or click anything. They do need network access to the switch, as Zyxel describes the attacker as being on the local network. If they manage to run commands, they can read data from the switch and change its settings. In the attacks GreyNoise described, attackers took configuration, network information and hashed admin credentials from the switches.

“Local network” does not mean safe. A single infected PC, a guest Wi-Fi that is not separated, or a management page accidentally reachable from the internet is enough.

Zyxel rated both flaws CVSS 8.8 out of 10 (version 3.1), which is high severity. The score is not critical mainly because the attacker has to be on the local network rather than anywhere on the internet. Otherwise it requires no login and has full impact on confidentiality, integrity and availability.

The CISA KEV catalog lists vulnerabilities that attackers are known to exploit. US federal agencies had to address CVE-2026-7273 by September 24, 2026. EPSS estimates the probability of exploitation in the next 30 days: as of November 5, 2026, it is 2.78% for CVE-2026-7273 (higher than 86% of known flaws) and 0.29% for CVE-2026-107441. It is a statistical estimate and for a fresh flaw it may not reflect that a working exploit already exists.

Who is affected

This affects Zyxel GS1900 switches running firmware 2.90 Patch 2 or earlier. Zyxel lists these models and vulnerable versions:

GS1900-8: 2.90(AAHH.2)C0 and earlier
GS1900-8HP: 2.90(AAHI.2)C0 and earlier
GS1900-10HP: 2.90(AAZI.2)C0 and earlier
GS1900-16: 2.90(AAHJ.2)C0 and earlier
GS1900-24: 2.90(AAHL.2)C0 and earlier
GS1900-24E: 2.90(AAHK.2)C0 and earlier
GS1900-24EP: 2.90(ABTO.2)C0 and earlier
GS1900-24HPv2: 2.90(ABTP.2)C0 and earlier
GS1900-48: 2.90(AAHN.2)C0 and earlier
GS1900-48HPv2: 2.90(ABTQ.2)C0 and earlier

These switches are common in offices, schools, clinics and branch sites. Models with HP in the name power cameras, Wi-Fi access points or IP phones over the network cable (PoE). They often run for years without a firmware update.

Zyxel states that other products on the market not listed are not affected. It released fixes for models still within their support period. If you have an older GS1900 model that is missing from the list, check its status with Zyxel or your reseller.

How to check if you are affected

After logging in to the switch’s web management, you will find the firmware version in the system information overview (System Information) under “Firmware Version”. This changes nothing.

If SSH access is enabled, log in and run a command that only prints the version:

show version

The number in brackets is what matters. If it shows .1 or .2 (for example 2.90(AAHK.2)C0), or you have even older firmware, the switch is vulnerable. Only the .3 build, 2.90 Patch 3, contains the fix.

Also check whether the switch’s web management is reachable from the internet, for example through port forwarding on your router or firewall, and which internal networks can reach it.

How to fix it

The fix is firmware 2.90 Patch 3. Each model has its own build:

GS1900-8: 2.90(AAHH.3)C0
GS1900-8HP: 2.90(AAHI.3)C0
GS1900-10HP: 2.90(AAZI.3)C0
GS1900-16: 2.90(AAHJ.3)C0
GS1900-24: 2.90(AAHL.3)C0
GS1900-24E: 2.90(AAHK.3)C0
GS1900-24EP: 2.90(ABTO.3)C0
GS1900-24HPv2: 2.90(ABTP.3)C0
GS1900-48: 2.90(AAHN.3)C0
GS1900-48HPv2: 2.90(ABTQ.3)C0

Watch out: if you installed Patch 2 after the June advisory, your switches are still vulnerable. According to Zyxel’s tables, Patch 3 is affected by neither flaw, so update straight to it from any older version.

List every GS1900 switch in the organization and its firmware version.
Start with those whose management is reachable from the internet or from less trusted networks (guests, Wi-Fi, regular users).
Download firmware only from Zyxel’s official site for the exact model. The code in brackets must match the model.
Back up the switch configuration.
Update during a maintenance window. The switch reboots, so the network and PoE-powered devices will briefly go down.
After the reboot, verify the version and that the network works.

Zyxel does not list a workaround. Until you update, restrict access to the web management: do not expose it to the internet and allow it only from a management network (VLAN) or from admin IP addresses.

What if you may already be compromised

In the attacks described by GreyNoise and quoted by Help Net Security, attackers stole configuration, network information and hashed admin credentials from the switches. Zyxel has not published specific indicators of compromise. Help Net Security advises administrators to update and also consider searching for evidence of compromise.

Change the passwords of all accounts on the switch and anywhere the same password is used.
Compare the configuration with an older backup: unknown accounts, VLAN changes, port mirroring, SNMP communities, access rules.
Review the switch logs and syslog for management logins from unknown addresses.
Check your firewall for connections from the switch’s IP address to the internet. A switch normally talks to almost nothing.

If you find anything suspicious, disconnect the switch, reset it to factory defaults, install Patch 3 and rebuild the configuration from scratch or from a verified backup taken before the attack. If findings are unclear or the switch carries a critical part of your network, bring in an incident response specialist.

Sources

Articles are put together by an AI agent from public sources (vendors, CISA, ENISA, NVD, SK-CERT, NÚKIB), and version numbers and CVEs are checked against them automatically. Always confirm the steps in the vendor advisory before touching production.

Zyxel GS1900 switches: local attackers can run commands, and the June patch is not enough