Zyxel patches GS1900 switches and dozens of access points

Zyxel patches GS1900 switches and dozens of access points

3 November 2026: Zyxel has published two advisories with firmware fixes: CVE-2026-107441, an out-of-bounds write in the web management CGI of its GS1900 smart switches that an unauthenticated attacker on the local network could use to run operating system commands, and CVE-2026-76955, a buffer overflow in the zdp_wtp binary of about 40 access points, the FWA7 range and the USG LITE 60AX security router that lets a LAN attacker raise privileges. Both advisories carry the revision line "2026-11-3: Initial release".

Not yet independently verified. Zyxel gives no CVSS score and says nothing about exploitation on either advisory, and we have not found an independent analysis of the two flaws beyond the Canadian Cyber Centre's pointer (AV26-1114). We will update this when it can be confirmed, and remove this note.

Ten GS1900 models and a crafted HTTP request

The switch flaw sits in the CGI program that serves the GS1900's browser interface. Zyxel says a crafted HTTP request from the LAN could "potentially execute OS commands", with no login needed. Ten models are listed, each fixed by moving from firmware 2.90(xxxx.2)C0 or earlier to the matching .3 build:

• GS1900-8, GS1900-8HP and GS1900-10HP;
• GS1900-16, GS1900-24, GS1900-24E, GS1900-24EP and GS1900-24HPv2;
• GS1900-48 and GS1900-48HPv2.

Zyxel says on-market models not in the table are unaffected, and that it patched only models still inside their vulnerability support period, so an older GS1900 that is not listed may simply be out of support rather than safe. Yegor Vasilenko of Binarly reported the flaw.

Access points, FWA7 and the USG LITE 60AX

The second advisory covers the NWA, WAX and WBE access point families across WiFi 6, 6E and 7, the IAP500BE, the FWA7 Root, Root Plus and Leaf Plus units, and the USG LITE 60AX. For most APs the fix is the next build of the same firmware line, for example NWA50AX 7.12(ABYW.1)C0 or WBE530 7.40(ACLE.2)C0. Two cases need attention:

• the USG LITE 60AX, affected from V2.00(ACIP.0)C0 to V2.30(ACIP.1)C0, is fixed in V2.40(ACIP.0)C0, which Zyxel says is "updated by cloud";
• the WAC500H, at 6.70(ABWA.7)C0 and earlier, gets only a hotfix that customers must request from their local Zyxel support team.

Jinpyo Lee is credited with the report.

What small offices should do first

Both flaws need an attacker who is already on the LAN, which lowers the urgency compared with an internet-facing bug but not by much in offices with guest networks, shared floors or flat networks where every laptop can reach the switch's management page. GS1900 switches are common in small businesses, branch offices and schools, and are often set up once and left alone.

Start with the switches: find every GS1900, compare its firmware string with the table, and update it. Where an update has to wait, restrict the management interface to an admin VLAN. For access points managed through Nebula, check the firmware the cloud has actually applied rather than assuming it; for a WAC500H, open a support case to get the hotfix.

Related on TrustList:

• Cisco Meraki hardening release covers seven flaw classes, top score 9.6

Sources

• Zyxel security advisory for out-of-bounds write vulnerability in GS1900 series switches, 3 November 2026
• Zyxel security advisory for buffer overflow vulnerability in certain APs, FWA7, and Security Routers, 3 November 2026
• Canadian Centre for Cyber Security: Zyxel security advisory (AV26-1114), 3 November 2026