Zyxel GS1900 Vulnerability Flagged by Canada

Zyxel has published patches for a pre-authentication out-of-bounds write in its GS1900 series switches, tracked as CVE-2026-107441. The vendor advisory, first released on 3 November 2026, says a LAN-based, unauthenticated attacker could potentially run OS commands through a crafted HTTP request against the CGI program in vulnerable firmware.

Canada’s Centre for Cyber Security followed with alert AV26-1114 and, in an Update 1 dated 4 November, wrote that “open-source reporting indicates that CVE-2026-107441 is exploited in the wild.” Zyxel’s own advisory does not say whether the new flaw has been used in attacks, and it lists no workaround beyond installing the fixed builds.

In brief

Zyxel patched a Zyxel GS1900 vulnerability (CVE-2026-107441) that can let a LAN attacker run OS commands via crafted HTTP.
Canada’s Cyber Centre says open-source reporting indicates exploitation; Zyxel itself does not claim that.
Ten GS1900 models on 2.90 Patch 2 and earlier need the Patch 3 builds; the issue was not in CISA’s KEV list when Research checked.

Which switches and what the fix is

Zyxel lists ten models still inside their vulnerability-support window: GS1900-8, -8HP, -10HP, -16, -24, -24E, -24EP, -24HPv2, -48 and -48HPv2. Firmware 2.90 Patch 2 and earlier is affected; Patch 3 builds such as GS1900-8 2.90(AAHH.3)C0 close the hole. Products not in the table are described as unaffected. Zyxel’s community firmware notes for the series also record a fix for the “Pre-authentication out-of-bounds write vulnerability” under this CVE.

The advisory credits Yegor Vasilenko and Fernando Mercês of Binarly for the report. Separate coverage in security outlets has reported that Binarly rates the issue 9.8 on the CVSS scale and says the exploit bypassed an earlier fix for CVE-2026-7273 that shipped in 2.90 Patch 2, after disclosure to Zyxel on 29 September. Zyxel’s CVE entry has been described as scoring 8.8. Those severity and bypass details are Binarly’s and the outlets’ reporting; they are not restated as Zyxel’s own assessment in the advisory TSN read.

GreyNoise has been reported as tying theft of data from 996 switches across 48 countries around 17 August to the earlier CVE-2026-7273. That figure should not be read as a victim count for CVE-2026-107441.

How seriously to take the exploitation claim

The Cyber Centre’s wording is careful: it points to open-source reporting, not to its own telemetry summary. That is still enough for Canadian administrators to treat the patch as urgent on any GS1900 that sits on a LAN where untrusted HTTP to the management CGI is possible. It is not the same as a CISA Known Exploited Vulnerabilities listing; Research did not find this CVE in KEV at the time of the brief.

Network gear with a pre-auth command path is a familiar pattern. Recent TSN coverage of Barracuda flaws that chain to root, Node-RED admin API abuse and SonicWall GMS end-of-life holes shows how quickly management interfaces become the soft middle of a LAN once a patch lags. Small business and branch switches are often left on factory firmware for years, which is why a “LAN-only” requirement is weaker comfort than it sounds.

Operators should inventory GS1900 units, confirm the Patch 3 build for each model in Zyxel’s table, and restrict management HTTP to trusted hosts while the upgrade rolls out. Watch for a CISA KEV entry or a clearer telemetry note from a national CERT if the open-source exploitation reports harden into confirmed campaigns.