What Happened
Binarly researchers found a new flaw in Zyxel GS1900 switches, The Hacker News reports. CVE-2026-107441 is an out-of-bounds write in the web request handler. An oversized 140th parameter overwrites the parameter counter, and the next parameter writes outside the buffer. The attacker runs commands as root.
Zyxel fixed an earlier flaw, CVE-2026-7273, in 2.90 Patch 2. The Patch 2 fix checks the counter after the copy, so it does not stop this attack. Patch 3, posted October 23, checks first and limits copy size. Binarly rates the new flaw 9.8 and Zyxel lists 8.8. The advisory offers no workaround.
Why This Matters for Canadian Organizations
GS1900 switches sit in small offices, clinics, schools, and municipal buildings across Canada. These sites rarely have a network team watching firmware notices. Many believe Patch 2 closed the problem, and CISA already lists CVE-2026-7273 in its Known Exploited Vulnerabilities catalog. Binarly says attackers held a working exploit before it reported the flaw to Zyxel on September 29.
The earlier campaign shows the stakes. GreyNoise saw attackers take data from 996 GS1900 switches, including configurations and hashed root credentials. Of those, 564 still used factory-default credentials. A stolen switch configuration maps your internal network. For organizations holding personal information, a breach with a real risk of significant harm triggers PIPEDA reporting duties.
What to Do
Inventory every GS1900 model and check the firmware build. Any build ending in .2 needs the matching .3 build. Block access to the management interface from untrusted networks, because Binarly says the attacker only needs reachability to the management service. Change default credentials and rotate any password stored on an affected switch. Review configurations for unfamiliar changes. Report confirmed compromise to the Canadian Centre for Cyber Security. Read more TechTalk coverage and our latest news.
