Zyxel GS1900 Patch Fails to Block Zero-Day Exploit Allowing Root Command Execution

Binarly researchers found that the June firmware fix Zyxel issued for actively exploited Zyxel GS1900 switches, addressing CVE-2026-7273, did not actually close the hole attackers were using. The company has now shipped a separate patch, 2.90 Patch 3, covering ten GS1900 models, to fix a newly tracked flaw, CVE-2026-107441, which lets anyone reach the switch's web management interface run commands as root without authentication. According to Binarly, the earlier Patch 2 update added a check that ran too late to stop the oversized-parameter attack, meaning devices believed to be fixed since September remained exploitable the whole time. GreyNoise had already reported in September that nearly a thousand GS1900 switches were scraped for configuration and credential data by a group linked to the Chinese-speaking actor Red Heron, underscoring the urgency for admins to install Patch 3 immediately since no workaround exists and it's unclear if prior compromises persist after updating.