Zyxel GS1900: check the model after an exploitation report

Reported exploitation is not a finding about your network

The 4 November update to Canadian advisory AV26-1114 states that open-source reporting indicates exploitation of CVE-2026-107441. This is attributed to that authority; the notice supplies neither a victim count nor an attack chain observed by SecuFocus.

The advisory also lists access points, FWA7 and Security Routers under a separate bulletin. That does not mean the same CVE or fixed firmware applies to all those devices.

GS1900-24E has a specific threshold, not a universal version

NVD's description covers GS1900-24E firmware through 2.90(AAHK.2)C0 inclusive. An out-of-bounds write in the CGI program could allow an unauthenticated attacker on an adjacent network to execute operating-system commands through a crafted HTTP request. This condition is not a claim that an attack can originate anywhere on the Internet.

Zyxel's version data in the NVD record also names other GS1900 models with different firmware identifiers. For example, GS1900-8 is listed through 2.90(AAHH.2)C0 inclusive. Keep those letters intact and do not use one model's firmware file on another.

Confirm the update for the actual device

The Canadian Cyber Centre recommends reviewing the linked bulletins and applying the necessary updates. The sources read here do not provide a complete model-by-model table of fixed firmware. Ask the maintainer to match the device label, its reported version and the corresponding update bulletin; we do not invent a fixed release by incrementing the vulnerable version number.

Meanwhile, check who can reach the switch's administration interface. Restricting access may reduce exposure but does not fix the flaw. Arrange a configuration backup and any interruption with the network administrator: the switch may carry connections that the site needs to operate.

• Remotely managed equipment: preserve necessary access↗

This is not a remote compromise diagnosis

This reading uses the revised Canadian advisory and NVD record, checked on 4 November. The NVD record does not yet contain CPE configurations; vendor version data is not an inventory of your network. SecuFocus has tested neither a device nor its firmware.

An updated firmware version does not prove that a device was never compromised. If settings or access have changed without explanation, have those findings examined separately rather than erasing them during a trial.