New critical Zyxel GS1900 switch flaw: the June patch fell short

Zyxel has confirmed a new critical flaw in its widely deployed GS1900 series managed switches. Published in a 3 November 2026 advisory, CVE-2026-107441 is a stack-based buffer overflow in the devices' web management interface. Binarly, the firmware security firm that found it, rates the issue 9.8 — critical.

What makes this case unusual is that the bug is not entirely new. Zyxel shipped a patch for a closely related flaw in the same component on 16 June 2026, tracked as CVE-2026-7273. When Binarly examined that fix on 28 September 2026, it found that all ten patched firmware builds were still exploitable: the update added a length check but left the unsafe copy operation at the root of the bug untouched. Zyxel confirmed the new flaw on 11 October, shipped a corrected build on 22 October, and published its advisory on 3 November.

Why this matters

The original flaw did not stay theoretical. Threat intelligence firm GreyNoise reported that around 17 August 2026 a single actor compromised 996 GS1900 switches across 48 countries. The attackers pulled device configuration files, hashed root passwords and network details off the switches. CVE-2026-7273 was added to the US cybersecurity agency CISA's Known Exploited Vulnerabilities catalogue on 21 September 2026.

Losing a switch is not the same as losing one endpoint. The switch is the spine of the network, and anyone holding its configuration learns the VLAN layout, the port mapping and the addressing of the management network. If stolen root password hashes are cracked — or if the same password was reused on other equipment — a single compromised switch becomes a path into everything behind it.

What it means for small and mid-sized businesses

The GS1900 line is popular precisely because it is affordable and capable: it sits in office floors, clinics, agency branches, logistics depots and small production sites in large numbers. These switches are typically installed once and then left alone for years. In most small businesses, firmware updating is not a scheduled process at all.

The second exposure is the management interface. Opening a switch's web panel to the internet for the sake of convenient remote access is what turns this flaw from a local risk into a directly exploitable one. There is a data protection angle too: if configuration data and credentials taken from a network device later lead an attacker into systems holding personal data, that becomes a reportable breach under Türkiye's KVKK regime.

The third and quietest risk is assuming a patch finished the job. A business that applied the June update and closed the ticket spent the months to late October believing it was covered while running an exploitable device. "We updated it" is not an answer; the installed build number has to be recorded.

What we recommend at Kamer Bilişim

• Check the firmware build now and move to the ".3" release. Builds ending in ".2" — the ones delivered by the June patch — are not protected against this flaw. Nothing is resolved until the ".3" firmware Zyxel published on 22 October 2026 or later is installed.
• Take switch management interfaces off the internet entirely. Administrative access belongs on a dedicated management VLAN or behind a VPN, with firewall rules restricting it to known source addresses.
• If a device was internet-facing, treat its credentials as stolen. Replace default and reused passwords, then review configuration changes and management-interface access logs going back through the summer.

Turning firmware status across your switches, firewalls and servers into a process that is actually tracked is what closes this class of flaw before it reaches you. We provide network infrastructure audits and managed maintenance agreements across Istanbul's Anatolian side and remotely — get in touch through our contact page to have your current setup reviewed.

Source: Cybersecurity News, GBHackers, Zyxel Security Advisories