A new target for affected switches
Zyxel’s November 3 advisory identifies CVE-2026-107441 in the web-management CGI program of its GS1900 switches. The company says a crafted HTTP request from an unauthenticated attacker on the local network could cause an out-of-bounds memory write and potentially execute operating-system commands. Its table covers ten models, with fixes for products still within their vulnerability-support period.
The model code matters
For the GS1900-24, Zyxel lists 2.90(AAHL.2)C0 and earlier as affected and 2.90(AAHL.3)C0 as the patch. The GS1900-8 instead uses the AAHH code. The distinction is operationally significant: a record saying only “2.90 installed” cannot establish which side of the vendor’s boundary a device occupies. The model and complete running build are the evidence needed to close that question.
A healthcare alert, not evidence of a healthcare breach
France’s CERT Santé published the issue for its healthcare audience on November 3, describing an adjacent-network attack requiring neither credentials nor user interaction and listing the corresponding fixed builds. That alert establishes relevance for healthcare IT teams using the equipment; it does not establish that a hospital was attacked. For a clinic or small business whose switching is maintained by an outside provider, the immediate accountability question is whether the provider can identify the installed model, show the running firmware and arrange the change around the services that depend on it.
Reachability remains part of the exposure
The LAN requirement narrows the attack path without making management access harmless. A switch’s exposure depends on which systems can reach that interface. This advisory therefore creates two separate operational facts to establish: whether the vulnerable build remains installed and who can reach it. Neither the product name alone nor a previously completed maintenance ticket settles both.
Sources & further reading
Our practical suggestions are editorial guidance. Verify applicability against current source and vendor instructions.
