Binarly found that Zyxel GS1900 switches running the vendor’s earlier Patch 2 firmware can still be attacked through a web-management flaw that allows unauthenticated command execution with root privileges, according to The Hacker News’ report.
The issue, tracked as CVE-2026-107441, affects Patch 2 builds for 10 models: GS1900-8, GS1900-8HP, GS1900-10HP, GS1900-16, GS1900-24, GS1900-24E, GS1900-24EP, GS1900-24HPv2, GS1900-48 and GS1900-48HPv2. The affected versions are the model-specific 2.90 Patch 2 builds and earlier; the fixed versions are the corresponding 2.90 Patch 3 builds.
The Hacker News reports that Binarly tested the exploit against emulated firmware and real hardware. The researchers said Patch 2 checks the number of request parameters only after copying an oversized parameter, allowing the exploit to corrupt the counter and redirect execution. Patch 3 checks the counter before copying and limits the size of the copy, according to the report.
The earlier Patch 2 release addressed CVE-2026-7273, which had already been exploited in attacks. SecurityWeek reported in September that GreyNoise observed a threat actor extracting configurations, hashed root credentials and network information from 996 GS1900 switches across 48 countries using that vulnerability in its coverage. The report said 564 of the devices still used factory-default credentials.
Those incidents do not establish that the targeted switches were running Patch 2, and The Hacker News reports that neither Binarly nor Zyxel has confirmed exploitation of CVE-2026-107441. Administrators should therefore distinguish the confirmed earlier attacks from the newly reported Patch 2 bypass: systems on Patch 2 or earlier need the model-specific Patch 3 firmware, while the available reporting does not establish whether updating removes access from a switch already compromised.