If you updated your Zyxel GS1900 switches over the summer to deal with an actively exploited vulnerability, you may not be done. Researchers at firmware security firm Binarly say the patch Zyxel shipped for that bug, firmware 2.90 Patch 2, did not stop the attack it was meant to stop. Zyxel has now released another update, 2.90 Patch 3, along with a new advisory and a new CVE.
The new flaw is tracked as CVE-2026-107441. Zyxel describes it as an out-of-bounds write in the CGI program that runs the switch's web management interface. An out-of-bounds write means the software writes data past the end of the memory buffer set aside for it. That can corrupt nearby memory, and in this case Zyxel says it could let an attacker run operating-system commands. According to the vendor, a "LAN-based, unauthenticated attacker" could do this by sending a crafted HTTP request. The attacker would not need a password.
How the first fix fell short
The story starts with CVE-2026-7273, a GS1900 vulnerability that Zyxel addressed in a June 16 advisory, naming 2.90 Patch 2 as the fix. On Sept. 21, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-7273 to its Known Exploited Vulnerabilities (KEV) catalog. KEV is CISA's list of bugs confirmed to be under active attack, and federal civilian agencies must fix the bugs on it by a set date. CISA gave agencies until Sept. 24.
Binarly's explanation of what went wrong, as reported by The Hacker News, is simple. Patch 2 added a counter check meant to stop the program from storing too many request parameters. That check runs only after the oversized parameter has already been copied into memory. By then the counter has already been overwritten, so the check cannot prevent the overflow. Binarly says the original exploit therefore still works against Patch 2 without changes, and that it tested this on emulated firmware and on real hardware.
Binarly reported the problem to Zyxel on Sept. 29. Zyxel posted Patch 3 firmware on its community forum on Oct. 23 and published the formal security advisory on Nov. 3. The same day, CVE-2026-107441 appeared in the National Vulnerability Database. Zyxel credits Binarly researchers Yegor Vasilenko and Fernando Mercês with the discovery.
Zero-day, or not?
The Hacker News headline and Binarly's framing call this a zero-day. Readers should be clear about what is and is not confirmed.
- Confirmed: CVE-2026-7273 was exploited in the wild, and CISA lists it in KEV.
- Per Binarly: the original exploit technique still works on Patch 2 firmware. So a switch patched against the known-exploited bug was, by Binarly's account, still open to the same exploit.
- Not confirmed: Zyxel's advisory does not say whether CVE-2026-107441 itself has been exploited. As of the sources reviewed here, CISA has not added CVE-2026-107441 to KEV.
There is related attack activity. According to The Hacker News, GreyNoise reported on Sept. 21 that attackers took data from 996 GS1900 switches around Aug. 17. Of those, 564 were still using factory-default credentials. GreyNoise tied the activity to CVE-2026-7273 and to a group that is the same as, or related to, what Acronis tracks as "Red Heron," which it describes as Chinese-speaking. That attribution comes from GreyNoise and Acronis, and ZeroDayFeed has not independently verified it. Also, neither GreyNoise nor Binarly says that the attacked switches were running Patch 2. The incident shows that GS1900 devices are being targeted. It does not show that the Patch 2 bypass has been used in an attack.
How bad is it?
The vendor and the researchers rate the severity differently. Zyxel's CVE entry gives it a CVSS 3.1 base score of 8.8 (High) with an "adjacent network" attack vector. That means Zyxel's position is that the attacker must already be on the local network segment. Binarly rates the flaw 9.8. It says the attacker's commands run with root privileges and that the attacker needs only network reachability to the management interface.
For most operators, the difference comes down to network layout. If a switch's web interface can be reached only from a locked-down management VLAN, an attacker would first need a foothold inside the network. If the interface is reachable from a flat office network, a guest segment, or (worse) the internet, the "adjacent" requirement provides little protection. The attacker also would not need credentials. That matters because, in the August incident, more than half of the 996 affected switches still used factory-default credentials.
A managed switch is also a valuable target. It is a privileged device that sees and forwards traffic, it rarely runs endpoint monitoring, and it often stays on old firmware for years. Gaining root on one gives an attacker a quiet place to persist and a vantage point for watching or redirecting traffic.
Binarly's advisory says it will soon publish a smaller proof-of-concept. Once that is public, defenders should expect the barrier to exploitation to drop.
What It Means for Defenders
Who is affected. Zyxel's Nov. 3 advisory lists ten GS1900 models running 2.90 Patch 2 builds and earlier:
- GS1900-8
- GS1900-8HP
- GS1900-10HP
- GS1900-16
- GS1900-24
- GS1900-24E
- GS1900-24EP
- GS1900-24HPv2
- GS1900-48
- GS1900-48HPv2
Zyxel says on-market products not listed in the advisory are unaffected.
What to install. The fix is the 2.90 Patch 3 build for each model. These builds end in .3)C0 and replace the vulnerable .2)C0 builds. Examples from Zyxel's advisory and firmware release post:
- GS1900-8: vulnerable on V2.90(AAHH.2)C0 and earlier; fixed in V2.90(AAHH.3)C0
- GS1900-24E: vulnerable on V2.90(AAHK.2)C0 and earlier; fixed in V2.90(AAHK.3)C0
- GS1900-48HPv2: vulnerable on V2.90(ABTQ.2)C0 and earlier; fixed in V2.90(ABTQ.3)C0
Check each switch's model and running firmware against the advisory's table rather than assuming one build fits all.
Do not treat Patch 2 as safe. If your records show these switches as "remediated" for CVE-2026-7273 because they run Patch 2, reopen those tickets. Based on Binarly's findings, the effective fix for the exploited bug is Patch 3. Teams tracking KEV deadlines, including federal contractors who report patch status for CMMC or agency requirements, should update their documentation to match.
No workaround. Zyxel's advisory does not list a workaround. Until you can update, reducing exposure is the only interim step, and it is not a substitute for patching:
- Make sure the web management interface is not reachable from the internet.
- Restrict management access to a dedicated management VLAN or a small set of administrator hosts.
- Keep user and guest segments away from switch management addresses.
Rotate credentials and look for signs of compromise. More than half of the switches in the August data theft still used factory-default credentials. Change any default or shared passwords on GS1900 devices. Because Binarly says exploitation gives root-level command execution, a switch that was reachable by untrusted hosts before patching should not be assumed clean. The advisory does not say whether updating removes access an attacker may already have. Review the switch's configuration for unexpected accounts, settings changes, or management access you did not authorize. If you have any doubt, plan to restore a known-good configuration after updating.
Watch for changes. Keep an eye on CISA's KEV catalog and Zyxel's advisory page. If CVE-2026-107441 is confirmed as exploited, or once Binarly's proof-of-concept is published, the urgency increases.
