Zyxel has released security updates for ten GS1900 models. Owners should match their exact model number and installed firmware.
Key points
- The security advisory covers ten explicitly listed switch models in the Zyxel GS1900 series.
- According to Zyxel, an unauthenticated attacker on the local network could exploit the flaw and potentially execute operating-system commands.
- Zyxel names a separate corrected firmware version for each listed model. What matters is the exact model code and full version number.
Anyone running a Zyxel GS1900 switch should look beyond the product name: on 3 November 2026, the manufacturer reported a vulnerability affecting ten models and published matching firmware fixes. Whether a device is affected depends on the exact combination of model and installed version.
The flaw is tracked as CVE-2026-107441. Zyxel describes a flaw in the switch firmware’s CGI program: an unauthenticated attacker on the local network could send a specially crafted HTTP request and potentially execute operating-system commands. The manufacturer recommends installing the available updates. The advisory does not state that attackers are already exploiting the flaw.
Which GS1900 models and versions are affected
Zyxel’s security advisory lists the affected firmware levels model by model. In the list, “and earlier” means that previous firmware versions also count as affected. The version codes in brackets are part of the match and should be copied in full.
- GS1900-8: affected up to and including 2.90(AAHH.2)C0; fix: 2.90(AAHH.3)C0.
- GS1900-8HP: affected up to and including 2.90(AAHI.2)C0; fix: 2.90(AAHI.3)C0.
- GS1900-10HP: affected up to and including 2.90(AAZI.2)C0; fix: 2.90(AAZI.3)C0.
- GS1900-16: affected up to and including 2.90(AAHJ.2)C0; fix: 2.90(AAHJ.3)C0.
- GS1900-24: affected up to and including 2.90(AAHL.2)C0; fix: 2.90(AAHL.3)C0.
- GS1900-24E: affected up to and including 2.90(AAHK.2)C0; fix: 2.90(AAHK.3)C0.
- GS1900-24EP: affected up to and including 2.90(ABTO.2)C0; fix: 2.90(ABTO.3)C0.
- GS1900-24HPv2: affected up to and including 2.90(ABTP.2)C0; fix: 2.90(ABTP.3)C0.
- GS1900-48: affected up to and including 2.90(AAHN.2)C0; fix: 2.90(AAHN.3)C0.
- GS1900-48HPv2: affected up to and including 2.90(ABTQ.2)C0; fix: 2.90(ABTQ.3)C0.
Zyxel also states that products still on sale but not listed in the table are not affected. That is not a blanket clearance for any older device or firmware level: if you cannot match a model designation exactly, use the support page or contact Zyxel before installing an update, rather than flashing firmware meant for a similarly named switch.
How to check and update your switch
First note the complete model designation from the device label or the management interface. Then read off the installed firmware version and compare it character by character with the matching line in the manufacturer’s list. A number such as “GS1900-24” is not enough if the device is actually a “GS1900-24E” or a “GS1900-24HPv2.”
If the version is at or below the affected level Zyxel names, download the fix only for that exact model from the official Zyxel download library. Model pages can carry different firmware packages, so do not use a file that merely sounds similar. Back up the configuration before making changes, and schedule a maintenance window for any switch used in business operations. After the update, check again that the displayed firmware version matches the fix named in the security advisory.
Zyxel’s GS1900-8 user guide describes firmware management and names “System Info” as the place to check the installed version number afterwards. The interface and steps can differ by model and software level. If the version display, download or update path is unclear, contact Zyxel before installing a file.
In the UK, the National Cyber Security Centre (NCSC) generally advises installing vendor security updates for network equipment promptly as part of routine vulnerability management, rather than waiting for a wider patch cycle. NCSC guidance on vulnerability management.
Practical checklist
- Read the model code and, where applicable, “v2” exactly.
- Note the complete firmware version and compare it with the matching manufacturer line.
- Back up the configuration and use only the package for the exact model.
- After the update, check again whether the corrected version number is active.
What buyers of used GS1900 switches should watch for
Anyone looking to buy a used GS1900 should ask for the exact model number and firmware level before installing it. A photo of the nameplate and a screenshot of the system information are more informative than a general assurance that the device is “up to date.” The seller can also show whether the matching fix has already been installed.
If the device is still on an affected level, it does not automatically need to be replaced: Zyxel names a fix for all ten listed models. Buyers should, however, allow time for the model-specific download, a configuration backup and a check after the update. If the exact version cannot be determined, or no matching package exists for the specific model, the switch should not be treated as a trusted part of a business network until this is clarified. That is a precautionary recommendation, not a statement about an observed attack.
Frequently asked questions
Does every Zyxel GS1900 need to be replaced immediately?
No. Zyxel names corrected firmware versions for the ten listed models. First, the model and installed version need to be matched. A replacement cannot be inferred from the manufacturer’s advisory alone.
Can the vulnerability be exploited over the internet?
Zyxel describes an unauthenticated attacker on the local network and a crafted HTTP request. The manufacturer’s description therefore does not show that the switch is directly reachable from, or has been attacked over, the public internet.
What should I do if the firmware version is not clearly shown?
Clarify the model and version details via the Zyxel support page or manufacturer contact before updating. Do not try a firmware package for a seemingly similar model.
What should I ask for when buying a used device?
Ask for the complete model designation and proof of the installed firmware. Compare both with the manufacturer’s list and schedule the update before use if needed.
Your experience counts
Do you run or are you buying a GS1900 switch? What information on checking the model and firmware is still missing for you? Share your question or experience factually in the comments.
Sources and status
- Zyxel: security advisory on CVE-2026-107441, published 3 November 2026 – affected models, version thresholds and fixes.
- Zyxel: official download library – model-specific firmware packages.
- Zyxel: GS1900-8 user guide – firmware management and version display; model-specific reference, not a guide for every variant.
Research and data as of: 5 November 2026. Firmware details refer to Zyxel’s security advisory of 3 November 2026.
Transparency note: AI-assisted tools were used in researching, structuring and writing this article. The sources used are listed in the article. Publication takes place only after manual editorial approval. English translation of the German original on Net Trends.
Share this article
