CVE-2026-107441: Zyxel GS1900 switch flaw bypassed June patch, fixed 22 Oct

Zyxel has published a fix for CVE-2026-107441, a flaw in the web management program of ten GS1900 series switches that lets an unauthenticated attacker on the network run operating system commands. The reason it matters beyond one more advisory: security firm Binarly says an exploit found on attacker infrastructure still worked against all ten firmware releases that Zyxel had shipped in June as the fix for an earlier, actively exploited bug, CVE-2026-7273. Zyxel's new firmware is dated 22 October 2026 and its advisory went out on 3 November 2026.

Key points

• CVE-2026-107441 is an out-of-bounds write in the CGI program of Zyxel GS1900 series switch firmware; Zyxel says a LAN-based, unauthenticated attacker could run OS commands with a crafted HTTP request.
• Ten models are listed as affected, and each has a fixed release ending in .3 (for example GS1900-24E: 2.90(AAHK.3)C0); Zyxel lists no workaround.
• Rapid7's database lists a CVSS 3.1 score of 8.8 (vector AV:A, adjacent network); Binarly's write-up, as summarised by Cryptika, argues the flaw is reachable over normal HTTP and deserves a higher rating.
• Separately, GreyNoise reported that a suspected Chinese-speaking actor took data from 996 GS1900 switches in 48 countries, and 564 of those still used factory default logins.
• Zyxel has not said that CVE-2026-107441 itself is exploited in the wild, and the CVE is not in CISA's Known Exploited Vulnerabilities (KEV) catalogue, according to Rapid7. CVE-2026-7273 is in it.

What to do

• Check your models. The affected list is GS1900-8, -8HP, -10HP, -16, -24, -24E, -24EP, -24HPv2, -48 and -48HPv2. Zyxel says models not listed are unaffected.
• Update to the fixed release for your model. Zyxel's table gives, per model, the last affected release (2.90(xxxx.2)C0 and earlier) and the fixed one (2.90(xxxx.3)C0). The model-specific codes are: GS1900-8 AAHH, GS1900-8HP AAHI, GS1900-10HP AAZI, GS1900-16 AAHJ, GS1900-24 AAHL, GS1900-24E AAHK, GS1900-24EP ABTO, GS1900-24HPv2 ABTP, GS1900-48 AAHN, GS1900-48HPv2 ABTQ. Zyxel says patches are available for models still within their vulnerability support period.
• Do not assume the June update covers this. If a switch runs the firmware that fixed CVE-2026-7273, it is, per Binarly, still vulnerable to this bug.
• Take the web interface off untrusted networks. Zyxel's wording is that the attacker is LAN-based, so restrict management access to a trusted admin VLAN. This is our reading of the risk, not a Zyxel workaround.
• Change default passwords. GreyNoise found 564 of 996 victims on factory defaults.
• If a switch was exposed, treat its configuration and root password hashes as possibly stolen and rotate credentials, because the attacker collected hashed root credentials and device configurations (GreyNoise, via Help Net Security). Check for unexpected admin accounts, changed settings and odd web requests, as CISA advised for CVE-2026-7273.

What happened

Zyxel's advisory, dated 3 November 2026 (initial release), describes an out-of-bounds write vulnerability in the CGI program of GS1900 series firmware. It credits Yegor Vasilenko of Binarly for reporting it. The advisory does not give a CVSS score on the page; the entry in Rapid7's vulnerability database lists CVSS 3.1 base score 8.8 (High) with the vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and a publication date of 3 November 2026.

BleepingComputer reports that Zyxel shipped the fixes on 22 October 2026 and published the advisory on 3 November. It also reports Zyxel's own account of why this is a new CVE rather than a reopened one: the exploit also abused missing validation of HTTP parameter lengths, and the October firmware limits parameter sizes and validates the parameter count before copying data into memory.

Background

The story starts with a different flaw. CVE-2026-7273 is a stack-based buffer overflow in GS1900 switches running firmware 2.90(XXXX.1)C0 and earlier. Zyxel's advisory for it is dated 16 June 2026. Help Net Security describes it as letting a LAN-based, unauthenticated attacker run OS commands through a crafted HTTP request.

On 21 September, GreyNoise reported that a suspected Chinese-speaking actor had exploited it. According to Help Net Security's summary of the report, the actor took configuration files, networking information and hashed root credentials from 996 devices in 48 countries, with attacks on or about 17 August. Affected devices were mainly in Italy, the United States, Taiwan and South Korea, plus several EU countries. GreyNoise found the exploit was a script protected with the commercial obfuscator PyArmor, and linked the activity to the same or a related actor as earlier WordPress and Gitea campaigns. BleepingComputer adds that GreyNoise tracks the actor as Kapibala and ties it to the Red Heron campaign, which Acronis had linked to a Gitea flaw.

CISA added CVE-2026-7273 to its KEV catalogue the same day, 21 September, per BleepingComputer, and Help Net Security reports that US civilian federal agencies had until 24 September 2026 to remediate and check for signs of compromise.

How the patch gap emerged

Binarly says it found an exposed archive containing the obfuscated exploit while investigating infrastructure tied to the JITTERLY backdoor and SIXZUT rootkit, according to BleepingComputer. The exploit checked for firmware versions that were patched against CVE-2026-7273. On 28 September, Binarly confirmed that it still worked against all ten patched releases, and reported the issue to Zyxel on 29 September. Zyxel confirmed a new flaw on 11 October, assigned CVE-2026-107441, and shipped fixed firmware on 22 October.

Binarly's explanation, as relayed by BleepingComputer and Cryptika, is that the earlier fix added buffer-overflow checks, but the attacker could bypass them by corrupting a parameter counter before it was validated. Cryptika's write-up of the advisory gives more detail that we could not confirm against Binarly's own page, which would not load for us: the web page keeps request parameters in a fixed block of 140 slots of 1,024 bytes each, the code copies data before it checks the count, and a long value in the last slot can overwrite the counter. Treat those specifics as Binarly's claims as reported by a third party.

Factory default login564

Other (996 minus 564)432

GS1900 switches compromised in the GreyNoise report, by login type (switches)

	switches
Factory default login	564
Other (996 minus 564)	432

Source: GreyNoise via Help Net Security (996 total, 564 on factory defaults); other = 996 minus 564

The numbers

Two figures frame the exposure. GreyNoise's count is 996 compromised switches across 48 countries. Of those, 564 were running factory default credentials, which is 57 percent. The remaining 432 is our subtraction, not a GreyNoise number: those are the switches where the attacker presumably needed the flaw, though the sources we read do not break the 432 down further.

The timeline is the other number that matters. From Zyxel's first fix (16 June) to the fixed release that Binarly's finding led to (22 October) is 128 days, and from the first reported attacks (around 17 August) to the advisory (3 November) is 78 days. Those intervals are our arithmetic from the dates the sources give.

What it means

For people running these switches, the practical lesson is that a patched version number is not proof of safety when the patch is for a different bug. Anyone who updated to the June firmware and considered the matter closed should update again.

For Zyxel, the open question is process: a fix for an exploited bug was shipped, and an outside firm later reported a working exploit against the patched releases. Zyxel treats it as a separate flaw, which leaves customers to work out which firmware they need.

Severity is also contested. Zyxel describes a LAN-based attacker and Rapid7 lists an adjacent-network vector with 8.8. Binarly, per Cryptika, says the flaw lives in global memory rather than on the stack as Zyxel described the earlier one, and that it works over normal HTTP from any network that can reach the switch, which would put it above 8.8. If your switch's web interface is reachable from the internet, the difference does not matter: patch now.

What we don't know yet

• Whether CVE-2026-107441 is being exploited in the wild. The exploit Binarly tested came from attacker infrastructure and targeted patched firmware, but neither Zyxel nor CISA has said the new CVE is exploited, and Rapid7 shows it outside the KEV catalogue at the time of writing.
• Whether the exploit was built to bypass the June patch or aimed at a related flaw the update missed. BleepingComputer lists this as an open question.
• The exact start of the attacks. Sources give around 17 August; we did not find an earlier date in the reports we could open.
• Binarly's own advisory text. Its page would not load for us, so its details come through third-party reports.
• Whether the CVSS score will change. The score we have is from Rapid7's database, not Zyxel's page.

What to watch next

Watch Zyxel's advisory page for revisions, since its history so far has one entry. Watch CISA's KEV catalogue for CVE-2026-107441, which would confirm exploitation and set a federal deadline. Watch for Binarly's technical write-up and for any GreyNoise update on whether the actor moved to the new bug. And check whether Zyxel announces fixes for any model outside its vulnerability support period.

Sources

• Zyxel security advisory: out-of-bounds write vulnerability in GS1900 series switches (primary)
• Binarly advisory BRLY-2026-057 (page would not load in full for us)
• Rapid7: CVE-2026-107441
• BleepingComputer: Zyxel fixes zero-day exploited to hack nearly 1,000 network switches
• Help Net Security: attacker compromised nearly 1000 Zyxel switches since August (CVE-2026-7273)
• Cyber Security News via Cryptika: Hackers exploit Zyxel GS1900 zero-day