Zyxel GS1900 Zero-Day: Patch 3 Fixes Bypassed Bug
Zyxel has released new firmware for 10 GS1900 switch models to fix CVE-2026-107441, an out-of-bounds write that lets an unauthenticated attacker run OS commands on the switch. The flaw sits underneath an exploit that attackers had already used against nearly 1,000 GS1900 switches, and that exploit still works on the firmware Zyxel shipped in June to stop it.
Binarly researchers, who found and reported the issue, say the June release (2.90 Patch 2) fixed only part of the bug behind CVE-2026-7273, the earlier GS1900 flaw that CISA added to its Known Exploited Vulnerabilities (KEV) catalog in September. Switches running Patch 2 need the new 2.90 Patch 3 build for their model.
Why Are There Two CVEs for One Exploit?
The vulnerability originates from CVE-2026-7273 (CVSS 8.8), a stack-based buffer overflow in the GS1900 CGI program that Zyxel disclosed and patched on June 16, 2026.
In September, researchers reported that a single threat actor had used a novel exploit around August 17 to pull data from 996 GS1900 switches in 48 countries. They tied the activity to CVE-2026-7273, and CISA added that CVE to KEV on September 21 with a federal due date of September 24.
Binarly had separately recovered the exploit itself. Its technical analysis shows that the code abuses a weakness Patch 2 never closed. Zyxel told Binarly that CVE-2026-7273 covered a missing check on the number of request parameters, while the missing check on parameter size is a separate flaw, now tracked as CVE-2026-107441.
Binarly presents two potential interpretations: either Patch 2 served as an incomplete remediation for CVE-2026-7273, or the observed in-the-wild attacks leveraged a distinct vulnerability from the one designated in the KEV catalog. In either scenario, active exploitation preceded the release of a fix for the parameter size check, establishing CVE-2026-107441 as a zero-day vulnerability.
Inside the Parameter-Handling Bug
The flaw lives in dispatcher.cgi, the CGI program that handles requests to the switch’s web management interface. Binarly’s analysis describes the root cause at a high level:
- Fixed storage: The handler copies each HTTP request parameter into a fixed area sized for 140 parameters
- No size check: It never limited how large a single parameter could be, and before Patch 2 it did not limit the parameter count either
- Counter overwrite: An oversized 140th parameter overruns the area and overwrites the parameter counter, so the next parameter is written outside the area and can redirect execution to an attacker-chosen command
- Late check in Patch 2: The June fix added a counter check, but it runs only after the oversized parameter has already been copied, so the overwrite still happens
- Patch 3 order: The new firmware checks the counter before copying and limits the copy size
Commands run with root privileges. Binarly says the exploit runs against Patch 2 without modification, and the exploit’s own list of supported firmware includes the Patch 2 build for the GS1900-24. The company tested it on emulated firmware and on physical hardware.
How Serious Is CVE-2026-107441?
Severity depends on whose assessment you read. Zyxel, as the CVE Numbering Authority, scores the flaw at CVSS 3.1 8.8 with an adjacent attack vector, and its advisory describes a “LAN-based, unauthenticated attacker.” Binarly rates it 9.8 and says an attacker only needs network reachability to the management service.
The practical difference comes down to deployment. A GS1900 whose web interface is reachable only from a protected management VLAN presents far less risk than one reachable from user networks or the internet. The CWE classification is CWE-787 (Out-of-Bounds Write).
Firmware Builds That Need Patch 3
Zyxel’s security advisory, published November 3, lists these models. Zyxel’s release notes show that the Patch 3 firmware was posted earlier, on October 23.
| Model | Affected Firmware | Fixed Firmware |
|---|---|---|
| GS1900-8 | 2.90(AAHH.2)C0 and earlier | 2.90(AAHH.3)C0 |
| GS1900-8HP | 2.90(AAHI.2)C0 and earlier | 2.90(AAHI.3)C0 |
| GS1900-10HP | 2.90(AAZI.2)C0 and earlier | 2.90(AAZI.3)C0 |
| GS1900-16 | 2.90(AAHJ.2)C0 and earlier | 2.90(AAHJ.3)C0 |
| GS1900-24 | 2.90(AAHL.2)C0 and earlier | 2.90(AAHL.3)C0 |
| GS1900-24E | 2.90(AAHK.2)C0 and earlier | 2.90(AAHK.3)C0 |
| GS1900-24EP | 2.90(ABTO.2)C0 and earlier | 2.90(ABTO.3)C0 |
| GS1900-24HPv2 | 2.90(ABTP.2)C0 and earlier | 2.90(ABTP.3)C0 |
| GS1900-48 | 2.90(AAHN.2)C0 and earlier | 2.90(AAHN.3)C0 |
| GS1900-48HPv2 | 2.90(ABTQ.2)C0 and earlier | 2.90(ABTQ.3)C0 |
Zyxel says on-market products not listed in the table are unaffected. The advisory lists no workaround and does not mention exploitation, CVE-2026-7273 or steps for checking a switch that may already be compromised.
What Was the Impact of Exfiltrated Data?
The August campaign was a data-collection operation. The attackers used the exploit to drop a script that gathered switch configurations, hashed root credentials and network information, then left the output on the device for later retrieval. Of the 996 affected switches, 564 still used factory-default credentials.
Researchers assess that one actor, a suspected Chinese speaker, has been behind related activity since May 2026. They say it is the same as, or related to, the group Acronis tracks as Red Heron, based on a shared command-and-control (C2) domain, a common malware family, exploitation of Gitea servers in July and overlapping tactics. Binarly found the GS1900 exploit on September 17 in an open directory on a server that also acted as C2 for the JITTERLY backdoor, which Acronis had linked to Red Heron’s Gitea campaign.
Neither research team states which firmware the compromised switches were running, or whether any of them already had Patch 2 installed. The published reporting also gives no GS1900-specific indicators of compromise.
What Is the KEV Status and the Patch 2 Gap?
CVE-2026-7273 remains in KEV, and agencies that met the September 24 deadline by installing Patch 2 are still exposed to the same exploit. As of reporting on November 5, CVE-2026-107441 had not been added to the catalog.
The KEV due date formally applies only to U.S. Federal Civilian Executive Branch agencies. For other organizations, a KEV entry whose required fix turned out to be incomplete is a reason to treat the Patch 3 upgrade with the same urgency as the original listing. Binarly also says it plans to publish a smaller proof-of-concept exploit, which would make the bug easier to reproduce.
What Steps Should GS1900 Owners Take?
Upgrading is the only vendor fix. The remaining steps below are general hardening and response measures, not Zyxel guidance:
- Upgrade every GS1900: Install the Patch 3 build for each model, including switches already updated to Patch 2
- Restrict the management interface: Limit access to the web interface to a dedicated management network and confirm it is not reachable from the internet
- Replace default and shared credentials: Change factory-default passwords, and rotate the root password on any switch exposed before the upgrade, since hashed root credentials were among the stolen data
- Review configurations: Compare current switch configurations against known-good backups and look for unexpected accounts, VLAN or port changes and new management access rules
- Plan for hidden compromise: A firmware upgrade fixes the flaw but is not evidence that a previously exposed switch is clean; consider resetting and reconfiguring switches that were reachable by untrusted hosts since August
Finding Forgotten Switches With SOCRadar
Small managed switches often sit outside central patch processes, and a Patch 2 build can look compliant on paper while remaining exploitable. Closing that gap starts with knowing where GS1900 management interfaces are exposed.
- Attack Surface Management: Discovers internet-facing assets, including network device management panels, so teams can find exposed GS1900 interfaces and confirm they run Patch 3
- Cyber Threat Intelligence: Tracks CVE-2026-107441 and CVE-2026-7273 as KEV status, exploit releases and attribution reporting change
Determining whether a specific switch was compromised still requires review of its own configuration, logs and network traffic.
