Back to Blog

You Applied the Zyxel Patch in June. Nearly 1,000 Businesses Did Too. Their Switches Got Hacked Anyway.

Network switches are the unsung infrastructure of a small business office. They’re the boxes in the closet or rack that everything plugs into, and most business owners never think about them. The router gets changed, the firewall gets patched, the PCs get updates, but the switch? It just sits there.

That assumption cost nearly 1,000 businesses something they didn’t expect to lose: their network credentials and configuration files. And a lot of them thought they were safe, because they had already patched.

What happened

Zyxel is a networking hardware vendor whose GS1900 series switches are common in small and mid-sized offices. Back in June, Zyxel issued firmware Patch 2 to address CVE-2026-7273, a vulnerability in the switch’s web management interface.[1] Organizations that applied it reasonably thought the issue was closed.

It wasn’t. Firmware security firm Binarly found that the original fix was incomplete. The underlying flaw, an out-of-bounds write in the same web interface, was still reachable after Patch 2. An unauthenticated attacker with network access could send a crafted HTTP request and execute OS-level commands on the switch. No login required.[2]

Zyxel assigned this residual bug its own CVE, CVE-2026-107441, and released Patch 3 on October 22. The official advisory came November 3. By then, according to GreyNoise data, 996 GS1900 devices across 48 countries had already been compromised.[3]

The attackers were after two things: the switch’s configuration files and stored credentials. Configuration files map out the entire network, including VLANs, port assignments, and remote management settings. Credentials open the door to further access. It’s the kind of reconnaissance that precedes a bigger attack.

Why this is harder than it looks

The frustrating part of this story isn’t the original vulnerability. It’s that the first patch, Patch 2, is still listed in CISA’s Known Exploited Vulnerabilities catalog as the fix for CVE-2026-7273.[1] Federal agencies and businesses that checked “patch applied” against that CVE were technically compliant. They were still running exploitable firmware.

Binarly reportedly traced the exploitation to a threat actor linked to previous Chinese state-sponsored activity.[4] Whether that attribution holds up doesn’t change much for a small business in Pittsburgh, though. The technique works from anywhere on a network that can reach the switch’s management interface, and it works against a device that most businesses assume doesn’t need attention.

What you actually need to do

First, figure out whether you have any Zyxel GS1900 switches. The affected models include the GS1900-8, GS1900-8HP, GS1900-10HP, GS1900-16, GS1900-24, GS1900-24HP, GS1900-48, and GS1900-48HP. If you’re not sure what switches you have, that’s worth knowing regardless of this story.

If you do have one, you need firmware version 2.90 Patch 3 or later, not Patch 2. Zyxel’s download portal is the right place to get it. Stopping at Patch 2 leaves you exposed even though it looks like a patched device.[2]

Second, if you’ve been running GS1900 firmware at or below Patch 2 for the past few months, consider changing your network passwords. The attackers were specifically taking configuration files and credentials. Credentials that may have been on a compromised switch aren’t credentials you can trust anymore.

Third, block external access to your switch management interface if you haven’t already. The GS1900’s web interface should not be reachable from the internet. If your switch management is exposed, your exposure isn’t just this CVE, it’s every future one too.

The bigger pattern here is one we see repeatedly: a patching process that checks boxes without tracking whether the patch actually addressed the vulnerability. “We applied the June firmware” and “we are protected from CVE-2026-7273” turned out to mean two different things.