Zyxel's fix for a hacked network switch flaw does not fully work

If your office runs a Zyxel GS1900 network switch and you installed the last update, you may still be exposed. Security firm Binarly found that the earlier fix does not stop the attack that hackers were already using. Zyxel has now released a newer update for 10 switch models.

What changed

The earlier fix is the 2.90 Patch 2 firmware, named in a June 16 advisory for a flaw tracked as CVE-2026-7273. The new 2.90 Patch 3 firmware fixes a related flaw now tracked separately as CVE-2026-107441. Zyxel posted it on October 23 and announced it in an advisory earlier this week.

The exploit lets anyone who can reach a switch's web management page run commands on it without logging in. The researchers say those commands run with root privileges, which means full control of the device. They rate the flaw 9.8 out of 10 for severity.

Why the first fix fell short

The switch's web program stores each request detail in a fixed space that holds 140 items. The exploit sends an oversized 140th item that spills past the end and throws off the program's count. Patch 2 added a check on that count, but it runs after the oversized item is already copied. By then the check is too late. Patch 3 checks first and limits the size of the copy.

Who it affects

The alert covers 10 GS1900 models running Patch 2 or older firmware. These are mostly used by businesses and the IT teams that manage them. The researchers say the new flaw is present in all 10 Patch 2 builds.

Real attacks have happened. GreyNoise, a firm that tracks attack traffic, reported that attackers took data from 996 GS1900 switches around August 17. Of those, 564 still used factory-default logins. The data included switch settings, scrambled root passwords and network information. Neither GreyNoise nor Binarly says the attacked switches had the earlier fix, so it is unclear how many were on Patch 2.

Zyxel's advisory describes the attacker as someone on the local network. The researchers say an attacker only needs to be able to reach the management page. That gap is a reason not to assume your switch is safe.

What to do

The steps are in the alert box above. The main one is to install the Patch 3 build for your exact model. Zyxel's advisory lists no workaround for owners who cannot update yet, so updating is the only fix it offers.

What is not known yet

Zyxel's advisory does not say whether updating removes access an attacker may already have. It also gives no guidance on what to check if a switch may have been compromised. It does not say whether the new flaw has been exploited.

The researchers say they will soon publish a smaller version of the exploit as a proof of concept. That could make it easier for others to copy. The U.S. cybersecurity agency CISA added the earlier flaw to its list of exploited vulnerabilities on September 21. Its data, last updated yesterday, does not list the new one.