Overview
A wave of attacks on Zyxel GS1900 series switches that was first attributed to an already-patched vulnerability was in fact exploiting a previously unknown zero-day, tracked as CVE-2026-107441.
GreyNoise initially tied the activity to CVE-2026-7273. Binarly then identified the real flaw and reported it to Zyxel on September 29. Zyxel's June fix addressed a separate buffer overflow, so switches running that update stayed exploitable.
The Vulnerability
| Field | Detail |
|---|---|
| CVE | CVE-2026-107441 |
| Type | Out-of-bounds write in the firmware's CGI program |
| Impact | OS command execution via crafted HTTP requests |
| Affected | Ten GS1900 models, firmware ending in .2C0 and earlier |
| Fixed in | Firmware ending in .3C0 |
| Zyxel CVSS | 8.8 (Zyxel says the attacker must be on the local network) |
| Binarly CVSS | 9.8 (network access to the management service is enough) |
According to the researchers' analysis, the code copies data before checking the parameter count, and a long value in slot 139 overwrites the counter itself.
Scale of Exploitation
Reporting indicates attackers compromised about 996 devices across 48 countries, stealing configuration files and credentials. Zyxel released firmware updates on October 22, 2026 (some sources say October 23) and published its advisory on November 3. As of November 5, CVE-2026-107441 had not been added to CISA's KEV catalog, while CVE-2026-7273 remains listed.
What To Do
- Update GS1900 firmware to the .3C0 release for your model.
- Do not expose switch management interfaces to the internet. Restrict the web UI to a dedicated management VLAN.
- Treat exposed or unpatched devices as compromised: rotate credentials and review the stored configuration, since configuration files were stolen.
- Don't assume a patch closes the case. Verify the CVE a fix addresses against the one being exploited, as this incident shows.