Zyxel GS1900 Switch Flaw CVE-2026-107441: Update Firmware

Short answer: Zyxel published a fix on November 3, 2026 for CVE-2026-107441, an out-of-bounds write (a memory error) in the web management program of GS1900 series switches. An attacker on the local network with no login could send a crafted web request and potentially run operating system commands. Install the patched firmware for your model and keep the switch's management page off the internet.

Which models need the update

Zyxel says firmware at the "affected" version or earlier is vulnerable. Install the matching fixed version.

Zyxel says the patches cover models still within their vulnerability support period, and that on-market products not in the table are unaffected. The advisory credits Yegor Vasilenko of Binarly for reporting the issue. It gives no workaround, so the firmware update is the fix. The advisory does not give a severity score or say whether the flaw is being exploited.

Step 1: find your switch model and firmware

Log in to the switch's web interface and open the system information page. Note the exact model name and firmware string, for example 2.90(AAHL.2)C0. Match both against the table.

Step 2: back up and install the new firmware

1. Export the switch configuration as a backup.
2. Download the fixed firmware for your exact model from Zyxel's support site.
3. Upload it through the switch's firmware management page and reboot when prompted.
4. Log in again and confirm the version now ends in .3)C0.

Plan a short outage, since the switch restarts and connected devices lose network for a few minutes.

Step 3: lock down the management page

• Do not expose the switch web interface to the internet. Check your router or firewall for port forwards to the switch.
• Put switch management on a separate management VLAN or restrict it to a few admin addresses.
• Change default or shared admin passwords.

Why act even without exploitation reports for this CVE

This is not the first GS1900 problem this year. Help Net Security reported that an attacker compromised nearly 1,000 Zyxel switches since August through an earlier flaw, CVE-2026-7273. If your switches were not updated after the June 2026 fix, update them now and consider changing credentials stored on them. Similar edge-device problems appeared in Cisco ASA and FTD and Ivanti Connect Secure.

Common mistakes

• Updating one switch and forgetting the rest of the stack or a spare in a cupboard.
• Reading "LAN-based" as "safe". Any compromised laptop or guest device on the network counts.
• Leaving the management page reachable from the internet.
• Not saving the configuration before a firmware upgrade.
• Assuming an unlisted model is vulnerable, or a listed one is fine because it is "old". Check the table.