SECURITY ADVISORY · PATCH AVAILABLE
The decision: check the exact model and install its .3 firmware
Zyxel says an unauthenticated attacker on the local network could exploit an out-of-bounds write in affected GS1900 switch firmware with a crafted HTTP request and potentially execute operating-system commands. [1]
Reporting cutoff: November 4, 2026, 6:12 p.m. EST (23:12 UTC).
This is a correction that changes the safe firmware baseline. Binarly reports that the exploit previously associated with CVE-2026-7273 actually targeted a separate zero-day, now CVE-2026-107441, and that all ten .2 firmware releases intended to address the earlier flaw remained vulnerable to the recovered exploit. [2]
2.90(Axxx.3)C0 release in Zyxel’s table. [1]Models and fixed firmware
Zyxel lists the following ten supported models and patches; on-market products absent from the table are described by Zyxel as unaffected. [1]
| Model | Affected version | Patch |
|---|---|---|
| GS1900-8 | 2.90(AAHH.2)C0 and earlier |
2.90(AAHH.3)C0 [1] |
| GS1900-8HP | 2.90(AAHI.2)C0 and earlier |
2.90(AAHI.3)C0 [1] |
| GS1900-10HP | 2.90(AAZI.2)C0 and earlier |
2.90(AAZI.3)C0 [1] |
| GS1900-16 | 2.90(AAHJ.2)C0 and earlier |
2.90(AAHJ.3)C0 [1] |
| GS1900-24 | 2.90(AAHL.2)C0 and earlier |
2.90(AAHL.3)C0 [1] |
| GS1900-24E | 2.90(AAHK.2)C0 and earlier |
2.90(AAHK.3)C0 [1] |
| GS1900-24EP | 2.90(ABTO.2)C0 and earlier |
2.90(ABTO.3)C0 [1] |
| GS1900-24HPv2 | 2.90(ABTP.2)C0 and earlier |
2.90(ABTP.3)C0 [1] |
| GS1900-48 | 2.90(AAHN.2)C0 and earlier |
2.90(AAHN.3)C0 [1] |
| GS1900-48HPv2 | 2.90(ABTQ.2)C0 and earlier |
2.90(ABTQ.3)C0 [1] |
Why the .2 release is no longer enough
Binarly says all ten .2 releases that addressed CVE-2026-7273 remained vulnerable to the recovered exploit. [2] Its analysis says the .3 code checks the parameter counter before copying and limits each field’s copy size, effectively fixing the newly assigned flaw. [2]
Binarly’s published timeline says Zyxel confirmed the new vulnerability on October 11, released the fixes on October 22, and published the CVE-2026-107441 advisory on November 3. [2]
Practical response sequence
- Confirm the exact model and installed build. [1] Compare both values with Zyxel’s model-specific affected-version table before changing anything. [1]
- If compromise is suspected, preserve available evidence before remediation. [3] Follow your organization’s authorized incident-response and evidence-preservation process before an upgrade, restart, or cleanup changes the record. [3]
- Install the matching .3 firmware from Zyxel. [1][2] Do not assume a .2 build is sufficient for CVE-2026-107441. [2] Zyxel advises affected users to install the released patches. [1] Binarly reports the earlier .2 builds remained vulnerable to the recovered exploit. [2]
- Limit management reachability. [1] Because Zyxel describes a LAN-based attack path, restricting the management interface to trusted administrative systems and networks is practical defense in depth, not a substitute for the fixed firmware. [1]
- Verify the running build. [1] After maintenance, confirm that the installed firmware exactly matches the .3 release listed by Zyxel for that model. [1]
Uncertainty: The vendor confirms the vulnerability, affected builds, attack condition, and patches. [1] Binarly reports exploitation as a zero-day and supplies the technical correction. [2] The reviewed sources do not identify a Treasure Coast organization or The IT Guys customer as affected, and this article does not claim a complete victim list. [1][2]
Sources
- Zyxel security advisory for out-of-bounds write vulnerability in GS1900 series switches — initial release November 3, 2026; retrieved November 4, 2026.
- Pre-Auth RCE in Zyxel GS1900 Exploited in the Wild as a Zero-Day — Binarly, November 3, 2026; retrieved November 4, 2026.
- NIST SP 800-61 Revision 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management — April 2025; retrieved from the frozen stable reference used for evidence-preservation guidance.