Zyxel GS1900 Patch 2 Does Not Block Zero-Day Root Command Execution Exploit

According to The Hacker News, Binarly researchers found that Zyxel GS1900 switches that received the vendor's earlier fix, the 2.90 Patch 2 firmware for CVE-2026-7273, are still open to the exploit attackers used. The exploit lets anyone who can reach a switch's web management interface run commands on it with root privileges and without logging in. Zyxel has released 2.90 Patch 3 firmware for 10 GS1900 models, which fixes the flaw now tracked as CVE-2026-107441.

GreyNoise reported that attackers took data from 996 GS1900 switches around August 17, and tied the attacks to CVE-2026-7273. Neither GreyNoise nor Binarly says the attacked switches were running the earlier fix. The vendor's advisory lists no workaround for owners who cannot update yet and does not say whether updating removes access an attacker may already have. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-7273 to its Known Exploited Vulnerabilities catalog on September 21.

Why it matters Organizations running GS1900 switches on Patch 2 or earlier firmware should treat the Patch 3 build for their model as the relevant fix, since the Patch 2 update does not stop the exploit according to the researchers. Because the vendor's advisory does not address compromise checks, investigators should consider whether switches with factory-default credentials or exposed management interfaces may already have been accessed. Our reading is that the earlier CISA listing covers only the original flaw, so patch status should be verified against CVE-2026-107441 as well.