Zyxel has released firmware updates for an unauthenticated remote-code-execution vulnerability in its GS1900 series switches after researchers linked the flaw to an attack campaign that compromised 996 devices across 48 countries, BleepingComputer reports.
The vulnerability, CVE-2026-107441, is an out-of-bounds write in the switches’ web management interface. According to the report, an attacker with network access could send specially crafted HTTP requests to execute operating-system commands. The flaw affects ten GS1900 models, and Zyxel released updates on October 22 before publishing its security advisory on November 3.
The exploitation was initially attributed to CVE-2026-7273, a different pre-authentication buffer-overflow vulnerability for which Zyxel released updates on June 16. In its earlier reporting, BleepingComputer described GreyNoise’s observation of the campaign beginning around August 17 and said the attackers used the switches to extract configurations, network information and hashed root-level credentials from 996 devices. That earlier report did not identify the newly assigned CVE-2026-107441.
The distinction matters for exposure assessment: systems updated for CVE-2026-7273 could still be vulnerable to the later exploit. BleepingComputer reports that Binarly found the recovered exploit remained effective against all ten firmware releases patched for the earlier flaw. The researchers said the earlier update’s overflow checks could be bypassed by corrupting a parameter counter before validation, while the new firmware limits HTTP parameter sizes and validates the parameter count before copying data into memory.
The reported compromise count and stolen data come from GreyNoise observations cited by BleepingComputer. The report does not establish how many affected devices remain exposed or whether every compromised switch was vulnerable to the newly assigned CVE. Administrators should use Zyxel’s current GS1900 security advisory and firmware releases to identify the applicable update.