Zyxel fixes zero-day used to take over nearly 1,000 GS1900 switches
Administrators who installed the June patch for the earlier flaw remained exposed and need the October firmware.
Zyxel has issued a fix for a previously unknown flaw in its GS1900 series switches, which attackers used to take over close to 1,000 devices in 48 countries. The flaw, tracked as CVE-2026-107441, let an unauthenticated attacker run operating system commands through crafted HTTP requests. It had been mistaken for CVE-2026-7273, an earlier issue patched in June, and the exploit kept working against switches already running those updates, which means administrators who relied on the June patch remained exposed. Researchers at Binarly found the exploit in an exposed archive tied to the Red Heron campaign and reported it to Zyxel on September 29. Zyxel confirmed the flaw on October 11 and released firmware on October 22 that limits parameter sizes and checks parameter counts before copying data. Operators of affected switches should install the latest firmware to close the gap.
Why it matters
The flaw was confused with an earlier issue that already had a fix, so organisations that treated the June update as complete were still open to the same attack. Because the exploit kept working on switches running those patched releases, the mistake left a wide population of devices exposed across many countries. For anyone following how network hardware gets secured, the case shows how a misidentified vulnerability can undermine a patch that appeared to be in place. The October 22 firmware is the step that closes the gap.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.