Zyxel’s latest GS1900 firmware update addresses a vulnerability that researchers say remained exploitable after an earlier security fix. The case shows why installing a patch and closing an attack path are not always the same thing.
A network administrator installs a security update and confirms that a switch is running the vendor’s patched firmware.
The vulnerability should now be addressed. But what if the attack technique still works?
That question became relevant to Zyxel GS1900 switches after researchers investigated attacks against devices that had received attention earlier in 2026.
On November 3, Zyxel published an advisory for CVE-2026-107441, an out-of-bounds write vulnerability affecting ten GS1900 switch models.
According to Zyxel, an unauthenticated attacker with LAN access to the management interface could potentially execute operating-system commands through a crafted HTTP request.
The company had already issued a different security fix for the same switch family in June.
The significance is not that all patches are unreliable. It is that an earlier correction did not prevent the attack technique later examined by researchers.
Two vulnerabilities, two firmware fixes
The sequence matters because the original investigation and the newer advisory concern separate CVE identifiers.
| Date | Verified development |
|---|---|
| June 16, 2026 | Zyxel published its advisory for CVE-2026-7273, a stack-based buffer overflow, with Patch 2 identified as the corrective firmware |
| On or about August 17, 2026 | GreyNoise’s timeline records exploitation and data theft against GS1900 switches |
| September 21, 2026 | GreyNoise published its campaign report, and CISA added CVE-2026-7273 to its Known Exploited Vulnerabilities catalog, according to Binarly’s timeline |
| September 2026 | Researchers investigated the exploit and the effectiveness of the earlier fix |
| October 23, 2026 | Zyxel posted its GS1900 Patch 3 firmware release notice |
| November 3, 2026 | Zyxel published its advisory for CVE-2026-107441 |
The June advisory concerned CVE-2026-7273. The November advisory identifies a separate out-of-bounds write weakness in the switches’ CGI program, which processes requests to the web-management interface.
Zyxel acknowledges Binarly researchers Yegor Vasilenko and Fernando Mercês for reporting the newer issue.
The company identifies version 2.90 Patch 3, with model-specific firmware identifiers, as the corrective release for CVE-2026-107441.
The October 23 release notice and November 3 security advisory are different events. The firmware announcement preceded the formal public vulnerability advisory.
June fix
On June 16, 2026, Zyxel published its advisory for CVE-2026-7273, a stack-based buffer overflow, with Patch 2 identified as the corrective firmware.
Exploitation
On or about August 17, GreyNoise’s timeline records exploitation and data theft against GS1900 switches. GreyNoise initially associated the exploitation with CVE-2026-7273.
Researchers’ finding
Binarly’s investigation reports that the attack technique remained effective against firmware containing the earlier Patch 2 correction. The detailed exploit behavior is a researcher finding, not a conclusion established independently by TechiesJournal.
Patch 3
Zyxel identifies version 2.90 Patch 3, with model-specific firmware identifiers, as the corrective release for CVE-2026-107441, an out-of-bounds write weakness in the switches’ CGI program.
Two events
The October 23 release notice and November 3 security advisory are different events. The firmware announcement preceded the formal public vulnerability advisory.
Sources: Zyxel’s June advisory, Patch 3 firmware release, and November advisory.
Why did the earlier fix not stop the attack?
An out-of-bounds write occurs when software writes data beyond the memory area intended to hold it.
Such a weakness can corrupt nearby memory. Depending on the program and execution conditions, that corruption may allow an attacker to change the program’s behavior.
In the GS1900 case, the affected component handles HTTP request parameters submitted to the switch-management interface.
Binarly’s investigation reports that the attack technique remained effective against firmware containing the earlier Patch 2 correction.
The researchers describe insufficient validation during request-parameter handling, allowing memory corruption before the earlier protective check could prevent the attack.
The resulting vulnerability is tracked as CVE-2026-107441.
Binarly reports that Zyxel considers the new issue separate from CVE-2026-7273. According to Binarly, Zyxel said the earlier vulnerability concerned a missing check on a parameter counter, even though its public description named a stack overflow, and treats the newer report as distinct because it also involves the lack of a parameter size check.
Zyxel’s public advisory confirms the out-of-bounds write and potential command execution. Its Patch 3 release notice confirms a fix for the new vulnerability.
Binarly’s assessment of the attack range is broader than Zyxel’s LAN condition. It rates the vulnerability 9.8 under CVSS v3.1 with a network attack vector, against the 8.8 that Zyxel assigned to the June vulnerability, because exploitation uses ordinary HTTP and needs only network reachability of the management service.
The detailed exploit behavior is a researcher finding, not a conclusion established independently by TechiesJournal.
This distinction matters because a fix may address one identified memory-safety condition without eliminating a related path through which an attacker can cause similar damage.
A successful firmware installation establishes which software version is running. It does not independently demonstrate that every previously observed attack technique has been eliminated.
Research: Binarly, New Zyxel GS1900 pre-auth RCE vulnerability revealed and Binarly vulnerability advisory BRLY-2026-057.
What is confirmed about the attacks?
GreyNoise documented a campaign involving Zyxel GS1900 devices and reported that attackers extracted sensitive data from 996 switches across 48 countries.
The activity included theft of device configurations, hashed root-level credentials and network information. GreyNoise also reported that 564 of the victims had factory default credentials.
GreyNoise initially associated the exploitation with CVE-2026-7273. Binarly subsequently reported that the attack technique exploited the separate weakness addressed as CVE-2026-107441.
CISA added CVE-2026-7273 to its Known Exploited Vulnerabilities catalog on September 21. Binarly argues that because the actor was exploiting a different vulnerability and the earlier patch remained ineffective, the resulting advice to upgrade did not protect devices from this actor. Binarly’s advisory adds that if the exploit targets a different vulnerability, CISA’s association of the activity with CVE-2026-7273 would be incorrect.
The available campaign evidence does not establish the firmware version installed on every compromised device.
It would therefore be inaccurate to claim that all 996 switches were compromised after Patch 2 had been installed.
The supported conclusion is narrower: there was documented exploitation of GS1900 devices, and researchers subsequently identified an attack path that the earlier update did not block.
Documented
GreyNoise documented a campaign involving Zyxel GS1900 devices and reported that attackers extracted sensitive data from 996 switches across 48 countries.
What was taken
The activity included theft of device configurations, hashed root-level credentials and network information.
Default credentials
GreyNoise also reported that 564 of the victims had factory default credentials.
Not established
The available campaign evidence does not establish the firmware version installed on every compromised device. It would therefore be inaccurate to claim that all 996 switches were compromised after Patch 2 had been installed.
The supported conclusion is narrower: there was documented exploitation of GS1900 devices, and researchers subsequently identified an attack path that the earlier update did not block.
Sources: GreyNoise, Open Season on Kapibala, CISA Known Exploited Vulnerabilities catalog entry for CVE-2026-7273 and Binarly’s timeline and advisory above.
Which switches need Patch 3?
Zyxel’s November advisory identifies ten affected GS1900 models.
| Affected model | Corrective firmware |
|---|---|
| GS1900-8 | 2.90(AAHH.3)C0 |
| GS1900-8HP | 2.90(AAHI.3)C0 |
| GS1900-10HP | 2.90(AAZI.3)C0 |
| GS1900-16 | 2.90(AAHJ.3)C0 |
| GS1900-24 | 2.90(AAHL.3)C0 |
| GS1900-24E | 2.90(AAHK.3)C0 |
| GS1900-24EP | 2.90(ABTO.3)C0 |
| GS1900-24HPv2 | 2.90(ABTP.3)C0 |
| GS1900-48 | 2.90(AAHN.3)C0 |
| GS1900-48HPv2 | 2.90(ABTQ.3)C0 |
For these models, Zyxel lists the corresponding `2.90(… .2)C0` firmware and earlier as affected.
Administrators should match the exact device model and installed version against the vendor’s advisory. Different models use different firmware identifiers.
Source: Zyxel, Security advisory for CVE-2026-107441.
What should administrators do?
Organizations operating GS1900 switches should identify affected devices, compare installed firmware with the November advisory and deploy the matching Patch 3 release.
Management-interface access should be restricted to authorized administrative networks and systems. On Binarly’s assessment, the relevant question is whether the management service is reachable from any untrusted network, not only whether an attacker sits on the LAN. Restriction can reduce exposure where a switch cannot be updated immediately, but it is not a substitute for applying the corrective firmware.
Organizations with evidence or reasonable suspicion of compromise should also investigate device configurations, management access and credentials.
An update addresses the identified software flaw. It does not automatically establish that a device was never compromised or that an attacker left no changes behind.
The checks should therefore reflect whether the device was merely vulnerable or may already have been exploited. GreyNoise’s finding that 564 of the victims had factory default credentials is a reminder that credential hygiene belongs to the same remediation.
What this incident teaches about remediation
The Zyxel case illustrates a distinction that security teams need to preserve.
A firmware inventory can confirm that a device is running the prescribed update. Security analysis can establish whether the observed exploit behavior remains possible. Incident investigation can determine whether the device was compromised before remediation.
These are related activities, but they answer different questions.
Firmware inventory
A firmware inventory can confirm that a device is running the prescribed update.
Security analysis
Security analysis can establish whether the observed exploit behavior remains possible.
Incident investigation
Incident investigation can determine whether the device was compromised before remediation.
Different questions
These are related activities, but they answer different questions. The practical lesson is to treat patch installation as an essential remediation step, not as automatic proof that every associated attack path and consequence has been resolved.
The practical lesson is to treat patch installation as an essential remediation step, not as automatic proof that every associated attack path and consequence has been resolved.
References and further reading
- Zyxel, Security advisory for CVE-2026-107441. November 3, 2026.
- Zyxel, Security advisory for CVE-2026-7273. June 16, 2026.
- Zyxel, GS1900 Series Patch 3 Firmware Release. October 23, 2026.
- Binarly, New Zyxel GS1900 pre-auth RCE vulnerability revealed. November 2026.
- Binarly, Vulnerability Advisory BRLY-2026-057. November 2026.
- GreyNoise, Open Season on Kapibala. September 21, 2026.
- CISA, Known Exploited Vulnerabilities catalog, entry for CVE-2026-7273. September 21, 2026.
Evidence cutoff: November 5, 2026. The Zyxel, GreyNoise and Binarly primary materials, including the full Binarly analysis and advisory BRLY-2026-057, were read directly and compared with this article. The exploit mechanics remain attributed to Binarly and were not reproduced by TechiesJournal.