Zyxel GS1900 network switches that received the vendor's earlier fix for an actively exploited flaw are still open to the exploit attackers used, researchers at Binarly found.

The exploit lets anyone who can reach a switch's web management interface run commands on it without logging in. Zyxel has released new firmware for 10 GS1900 models that closes the hole.

The earlier fix is the 2.90 Patch 2 firmware, named in a June 16 advisory for a flaw tracked as CVE-2026-7273. The new 2.90 Patch 3 firmware fixes a flaw now tracked separately as CVE-2026-107441, which the exploit relies on. It was posted on October 23, and the vendor announced it in an advisory earlier this week.

The researchers, who reported the flaw to the vendor on September 29, call it a zero-day. Attackers already had a working exploit for it by then.

GreyNoise, which monitors attack traffic through a network of sensors, reported on September 21 that attackers took data from 996 GS1900 switches around August 17. It tied the attacks to CVE-2026-7273, and the researchers say the exploit it described matches the one they found.

Neither GreyNoise nor Binarly says the attacked switches were running the earlier fix, and the vendor's advisory does not say whether the new flaw has been exploited.

Zyxel's security advisory lists the affected and fixed firmware for each model:

Switches on Patch 2 or any earlier firmware need the Patch 3 build for their model. The builds are posted with their firmware release notes .

Source link