# Zyxel GS1900: patch switches after reports of exploitation Canonical: https://www.oktsec.com/radar/zyxel-gs1900-cve-2026-107441 Publisher: Oktsec Language: en Published: 2026-11-04T20:47:43Z Updated: 2026-11-04T20:47:43Z Record reviewed: 2026-11-04T20:47:43Z Latest evidence check: 2026-11-04T20:47:43Z Disclosed: 2026-11-03 Canada’s Cyber Centre reports exploitation of CVE-2026-107441. Zyxel describes a path to operating system commands from the local network without authentication and provides firmware fixes for affected GS1900 models. ## Evidence and response priority - Category: Vulnerability - Oktsec priority: Act now - Rationale: Canada reports exploitation. The vendor describes access from the LAN without authentication; prioritize affected switches reachable from untrusted network segments. - Evidence: Attacks confirmed - Verification: Vendor confirmed - Fix status: Fix available - Exposure requirement: Application or configuration dependent - Vendor: Zyxel - Products: GS1900 series switches - CVEs: CVE-2026-107441 ## Technical overview The flaw is an out of bounds write in the CGI program of affected GS1900 firmware. Zyxel says an attacker on the LAN can send a crafted HTTP request without logging in and potentially execute operating system commands. The Canadian Cyber Centre updated its advisory on November 4 to report exploitation in the wild based on public reporting. The notice does not identify victims or quantify the attacks. This exploitation evidence concerns CVE-2026-107441; it must not be transferred to the separate Zyxel advisory covering access points, FWA7 and security routers. Zyxel provides a different firmware build for each supported model in the table below. Match the full model identifier, including hardware revisions. The vendor says products currently on the market that are not listed are unaffected; that statement is not proof that an unsupported legacy device has a correction. Oktsec recommends checking who can reach switch management, applying the appropriate correction and examining earlier activity. Network segmentation reduces exposure while patching is arranged; it does not replace the firmware fix. ## Recommended response Install the firmware correction for the exact switch model, restrict access to its management interface and review available logs for unexpected activity. Relevant to: Network teams operating the affected GS1900 switch models, including shared office, campus and branch networks. ## CVE attribution - CVE-2026-107441: Zyxel — GS1900 series switches. [Source](https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026) ## Affected systems and fixes ### GS1900-8 Affected: 2.90(AAHH.2)C0 and earlier Fixed release / action: 2.90(AAHH.3)C0 ### GS1900-8HP Affected: 2.90(AAHI.2)C0 and earlier Fixed release / action: 2.90(AAHI.3)C0 ### GS1900-10HP Affected: 2.90(AAZI.2)C0 and earlier Fixed release / action: 2.90(AAZI.3)C0 ### GS1900-16 Affected: 2.90(AAHJ.2)C0 and earlier Fixed release / action: 2.90(AAHJ.3)C0 ### GS1900-24 Affected: 2.90(AAHL.2)C0 and earlier Fixed release / action: 2.90(AAHL.3)C0 ### GS1900-24E Affected: 2.90(AAHK.2)C0 and earlier Fixed release / action: 2.90(AAHK.3)C0 ### GS1900-24EP Affected: 2.90(ABTO.2)C0 and earlier Fixed release / action: 2.90(ABTO.3)C0 ### GS1900-24HPv2 Affected: 2.90(ABTP.2)C0 and earlier Fixed release / action: 2.90(ABTP.3)C0 ### GS1900-48 Affected: 2.90(AAHN.2)C0 and earlier Fixed release / action: 2.90(AAHN.3)C0 ### GS1900-48HPv2 Affected: 2.90(ABTQ.2)C0 and earlier Fixed release / action: 2.90(ABTQ.3)C0 Confirm the running version against the vendor advisory, including any distribution backports. ## CISA KEV evidence Catalog: 2026.11.03 Checked: 2026-11-03T22:13:58Z No matching CVE appears in the reviewed catalog snapshot. CISA KEV inclusion establishes known exploitation of the listed CVE, not compromise of your environment. Absence does not rule out exploitation. The date added is not the first attack date. Federal deadlines and forensic triage requirements are context, not universal obligations for private organizations or businesses in Latin America. ## Supporting evidence Snapshot checked: 2026-11-04T12:33:51.947Z. These dates do not change the incident’s editorial review date. ### FIRST EPSS forecast No score returned for: CVE-2026-107441 EPSS is a prediction, not exploitation evidence or organization-specific risk. Confirmed exploitation takes precedence. A missing score is not zero. Check status: available; last successful check: 2026-11-04T12:33:51.947Z. ## Response checklist 1. **Match the model and firmware** — Record the exact GS1900 model, including HP and hardware revision suffixes, and the installed firmware. Use the matching row below; firmware build identifiers differ between models. 2. **Restrict management access** — Limit access to management interfaces to trusted administration paths and separate them from guest, user and other untrusted network segments. LAN access is an attack prerequisite, not evidence that every internet visitor can exploit a switch. 3. **Install the model-specific correction** — Use Zyxel’s official firmware for the exact model. Back up the configuration, arrange a maintenance window and verify the running firmware and connectivity afterward. 4. **Review earlier activity** — Preserve available management and network logs. Investigate unexpected configuration changes, accounts and connections. Where compromise is suspected, coordinate recovery and rotation of exposed management credentials; a firmware update alone does not establish that earlier access was harmless. ## Relevance to AI environments Compromised network management can affect access to business services and automation hosts; this advisory does not establish attacks targeting AI systems. ## Sources - [GS1900 affected models, firmware fixes and LAN access requirement](https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026) — Zyxel; Vendor notice; checked 2026-11-04T20:41:46Z - [AV26-1114 Update 1: exploitation reported November 4](https://www.cyber.gc.ca/en/alerts-advisories/zyxel-security-advisory-av26-1114) — Canadian Centre for Cyber Security; Government advisory; checked 2026-11-04T20:41:46Z ## Editorial record - 2026-11-04T20:47:43Z: Added verified scope, source evidence and response guidance. ## Use this advisory in Radar Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment. [Open advisory](https://www.oktsec.com/radar/zyxel-gs1900-cve-2026-107441) · [Build a response plan](https://www.oktsec.com/radar/zyxel-gs1900-cve-2026-107441#review-workspace) - [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=zyxel-gs1900-cve-2026-107441&service=exposure_check) - [Patch verification consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=zyxel-gs1900-cve-2026-107441&service=patch_verification) ## Scope and corrections Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure. [Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.