Zyxel GS1900 network switches that received the vendor's earlier fix for an actively exploited flaw are still open to the exploit attackers used, according to research from Binarly. The exploit lets anyone who can reach a switch's web management interface run commands as root without logging in.
What Was Found
The new flaw is tracked as CVE-2026-107441. It was not fixed by the earlier patch for CVE-2026-7273, which CISA added to its Known Exploited Vulnerabilities (KEV) catalog on September 21.
| Attribute | Detail |
|---|---|
| CVE | CVE-2026-107441 |
| Severity | 9.8 per Binarly; 8.8 per Zyxel's entry |
| Auth required | None |
| Impact | Command execution as root |
| Affected firmware | 2.90 Patch 2 and earlier |
| Fixed in | 2.90 Patch 3 (model-specific build) |
Affected models are GS1900-8, -8HP, -10HP, -16, -24, -24E, -24EP, -24HPv2, -48, and -48HPv2.
How the Exploit Works
The web request handler stores parameters in a fixed area that holds 140 entries, without checking parameter size. An oversized 140th parameter overwrites the counter, which lets the attacker redirect a function call to run a command. Patch 2 added a counter check, but it runs after the copy, so it does not stop the overflow. Patch 3 checks the counter before copying and limits the copy size.
Timeline
- Mid-August: GreyNoise tied attacks on 996 switches to CVE-2026-7273. Neither firm says whether those switches ran the earlier fix.
- September 21: CISA added CVE-2026-7273 to KEV.
- September 29: Binarly reported the new flaw to Zyxel and says attackers already had a working exploit.
- October 23: Zyxel released Patch 3.
- Early November: Zyxel published its advisory.
Zyxel's advisory does not say whether the new flaw has been exploited, and CVE-2026-107441 was not in the KEV catalog at the time of reporting. The same attacks also involved 564 switches still using factory-default credentials.
Recommended Actions
- Update every GS1900 switch to firmware 2.90 Patch 3 using the build for your model, for example 2.90(AAHH.3)C0 for the GS1900-8. No workaround is listed for devices that cannot update yet.
- Do not expose the web management interface to the internet or untrusted networks. Restrict it to a dedicated management VLAN.
- Change default credentials on all switches.
- Assume possible compromise for switches that were reachable while unpatched. The advisory does not say whether updating removes existing attacker access, so review configurations and logs.