Zyxel GS1900 CVE-2026-107441: Impact, Exposure and Mitigation

CyberInsights Today · Vulnerability analysis
By Harpreet Singh Virdi, CISSP, CCSP
Published and evidence checked: November 6, 2026. Vendor disclosure: November 3, 2026.

A switch can keep forwarding traffic while its management interface remains vulnerable. Start with the exact model and complete firmware identifier. A version that simply says “2.90” is not enough to close this issue.

What happened

Zyxel identifies CVE-2026-107441 as an out-of-bounds write in the GS1900 web interface’s CGI program. CGI is the component that processes web requests. An unauthenticated attacker with LAN access can send a crafted HTTP request that may lead to operating-system command execution. Zyxel advisory, November 3.

In plain English, software writes beyond the memory area intended for that operation. The advisory does not publish the exact request field or memory layout. This article therefore explains the trust boundary and prerequisites without inventing an exploit sequence.

Exploitation evidence and severity

NHS England’s November 5 alert assigns CVSS v3.1 8.8 and reports Binarly’s finding that an exploit existed before disclosure and still worked against 2.90 Patch 2. NHS National CSOC assesses further exploitation as likely. These statements establish a credible exploitation concern; they do not establish that any particular reader’s switch was compromised. NHS England CC-4885.

The NHS alert categorises its overall threat severity as Medium. That category and the 8.8 technical score measure different things. My assessment: prioritise reachable management interfaces and devices supporting important business traffic. Network adjacency reduces the set of possible attackers, but does not make a shared office LAN or a compromised administrator workstation trustworthy.

Which firmware needs attention?

Zyxel lists these affected models with Patch 2 and earlier firmware. Its fixed identifiers are below. Match the model-specific letters as well as the patch number; do not install another model’s image. Vendor affected-version table.

Business impact: assess the role of the switch

Potential command execution means the operating environment of a network device may be under an attacker’s control. As risk analysis, consider loss of management integrity, configuration changes and interruption to connected services. The precise outcome depends on privileges and device capabilities; the cited advisory does not prove a specific lateral-movement chain or data-theft outcome.

For a fictional branch office, ask which payment terminals, phones or access points depend on the switch. Document the effect of a reboot before patching. A short planned interruption is easier to manage than an unplanned loss of the same dependency.

Prioritised remediation

1. Inventory: record model, complete firmware, management address, owner and business dependency. Include spare and intermittently connected switches.
2. Reduce exposure: restrict management access to approved administration sources. Review access from guest, user and wireless networks. Validate both intended permissions and an unauthorised test source under your own assessment authority.
3. Install fixed firmware: use the appropriate official image, preserve a configuration backup securely, and plan recovery and maintenance access. Follow the product’s documented upgrade process.
4. Verify: after the required restart, read the running identifier from the device, test essential connectivity and recheck the management-access boundary.

The patch addresses the vulnerable code. Access restrictions are temporary containment and continuing defence in depth; they do not repair the CGI program. Do not rely on a public website WAF to protect an unrelated switch management interface. An ordinary HTTPS connection also does not correct memory corruption.

Detection and investigation

Preserve available management-access records, central logs and recent configuration exports before they rotate. Compare current configuration with an approved baseline. Investigate unexplained administrator changes, unexpected management connections and changes to segmentation or remote access. These are review leads, not signatures unique to this CVE.

The cited vendor advisory does not provide a complete detection rule set. A quiet log is not proof that exploitation never occurred, especially when device logging is limited. If evidence suggests compromise, isolate management access and involve your incident-response team; firmware installation alone does not prove that configuration and credentials remain trustworthy.

How to close the ticket

Keep evidence of the exact fixed image and running firmware, upgrade time, connectivity checks and tested access restrictions. Account for every affected device. Record exceptions with owners and deadlines. Use our production patch-verification lesson to separate an uploaded image from a verified running fix.

Key takeaways

Check the full firmware identifier, restrict who can reach management, install the correct fixed image and verify it after deployment. Treat exploitation reporting as a reason to prioritise action, while keeping device-specific compromise conclusions tied to evidence.

References

• Zyxel advisory — vulnerability, prerequisites and model-specific patches; initial release November 3.
• NHS England CC-4885 — CVSS scoring and attributed exploitation evidence; published November 5.

Independent instructional analysis. No exploit or device upgrade was tested for this article. Evidence last checked November 6, 2026. Editorial disclosure.

Originally published on WAF Protect.