In September, GreyNoise reported that attackers had hacked roughly 1,000 Zyxel GS1900 network switches in August, and blamed CVE-2026-7273, a bug Zyxel patched in June. CISA added that bug to its exploited list. Now Binarly says the attackers were actually using a different, unknown flaw, so the June patch did nothing to stop them, per SecurityWeek.
What the flaw does. The new bug, CVE-2026-107441 (CVSS 8.8), lets an attacker who hasn't logged in run commands on the switch by sending crafted web requests. It affects 10 GS1900 models. Zyxel released fixes on Oct 23 and published its advisory on Nov 3. The attacks have been linked to a Chinese group GreyNoise calls Red Heron.
Why small businesses should care. The GS1900 is an affordable managed switch, the kind that ends up in a small office closet and gets forgotten. If you patched in June and thought you were done, you weren't. A hacked switch sits in the middle of all your office traffic.
Action item: Check your switch this week.
1. Find out if you have one. Look at the label on the switches in your network closet, or ask whoever set up your network. You're looking for "GS1900."
2. Install firmware released on or after Oct 23. Check Zyxel's Nov 3 advisory for your exact model and fixed version.
3. Keep the switch's web page off the internet. Its management page should be reachable only from inside your office, never from outside.
4. If it was ever exposed online, assume it may have been touched. Update it, change its admin password, and consider a factory reset.
Not sure what's in your network closet? Call us at +1 (689) 225-0286.