Security · High impactFan score 73 · Tier A3 sources
Zyxel fixes zero-day exploited to hack nearly 1,000 network switches
BleepingComputer · By Lawrence Abrams ·
Zyxel has patched a zero-day vulnerability in its GS1900 series network switches that hackers exploited to compromise nearly 1,000 devices worldwide and steal configuration files and credentials. [...]
The Brief
- Zyxel's earlier patch for an actively exploited GS1900 switch flaw is incomplete; Binarly found patched switches still open to the exploit.
- The exploit lets anyone who can reach a switch's web management interface run commands on it.
- Attackers compromised nearly 1,000 devices worldwide and stole configuration files and credentials; the flaw is tracked as CVE-2026-107441.
Why it matters
If your network includes Zyxel GS1900 switches with a reachable web management interface, a patch alone may not protect them, and compromised switches can expose configuration files and credentials.
Who’s affected
- Teams running Zyxel GS1900 series switches
- Network administrators with GS1900 web management interfaces reachable from untrusted networks
What to do
- Restrict access to the GS1900 web management interface so it is not reachable from untrusted networks
- Check GS1900 switches for signs of compromise and review stored configuration files and credentials
- CVE-2026-107441
- #zyxel
- #network-security
- #zero-day
- #command-injection
- #switches
- #vulnerability
Timeline
Zyxel reported a patch for the zero-day exploited against GS1900 switches
BleepingComputer
Zyxel fixes zero-day exploited to hack nearly 1,000 network switches
Binarly found that switches with the earlier fix remain open to the exploit
The Hacker News
Zyxel GS1900 Patch Fails to Block Zero-Day Exploit Allowing Root Command Execution
SecurityWeek
Zyxel Switch Hacks Blamed on Patched Flaw Actually Exploited a Zero-Day
