{"id":3955,"date":"2026-11-05T07:09:16","date_gmt":"2026-11-05T15:09:16","guid":{"rendered":"https:\/\/cyber.mag212.com\/zyxel-gs1900-cve-2026-107441-june-patch-zero-day\/"},"modified":"2026-11-05T07:09:16","modified_gmt":"2026-11-05T15:09:16","slug":"zyxel-gs1900-cve-2026-107441-june-patch-zero-day","status":"publish","type":"post","link":"https:\/\/cyber.mag212.com\/fr\/zyxel-gs1900-cve-2026-107441-june-patch-zero-day\/","title":{"rendered":"Vuln\u00e9rabilit\u00e9 zero-day CVE-2026-107441 sur le Zyxel GS1900\u00a0: pourquoi le correctif de juin n\u2019a pas fonctionn\u00e9 et quel firmware la corrige\u00a0?"},"content":{"rendered":"

In August, attackers compromised close to 1,000 Zyxel GS1900 switches. The attacks were blamed on CVE-2026-7273<\/strong>, a flaw Zyxel had fixed in June. Now Binarly says the attackers’ own exploit still worked on the June-patched firmware. Zyxel has assigned a new CVE, CVE-2026-107441<\/strong>, and released 2.90 Patch 3<\/strong>. If you patched in June, you need to patch again.<\/p>\n\n

Faits cl\u00e9s<\/h2>\n\n
Article<\/th>D\u00e9tail<\/th><\/tr><\/thead>
CVE<\/td>CVE-2026-107441, out-of-bounds write (CWE-787) in the switch CGI program<\/td><\/tr>
Score<\/td>CVSS 3.1 8.8 (Zyxel, CNA); vector AV:A, adjacent network, no login<\/td><\/tr>
Affected<\/td>Ten GS1900 models on 2.90(xxxx.2)C0 or earlier<\/td><\/tr>
Fix<\/td>2.90(xxxx.3)C0 (“Patch 3”); no workaround<\/td><\/tr>
Advisory<\/td>Zyxel, November 3, 2026; Patch 3 announced October 23<\/td><\/tr>
Exploitation<\/td>In the wild according to Binarly; Zyxel\u2019s advisory does not say; not found in CISA KEV<\/td><\/tr><\/tbody><\/table><\/figure>\n\n

What happened<\/h2>\n\n

GreyNoise documented the campaign in September: 996 compromised switches in 48 countries<\/strong> from about August 17, 564 of them still using default passwords. CISA added CVE-2026-7273 to its Known Exploited Vulnerabilities catalog on September 21. The fix for that flaw had shipped in June.<\/p>\n\n

Binarly then recovered the attackers’ exploit, exp.py<\/code>, from an open directory on their command server. It targets \/cgi-bin\/dispatcher.cgi<\/code>. According to Binarly, it still ran commands without authentication on all ten firmware builds that carried the June fix. Zyxel credited Binarly researchers Yegor Vasilenko and Fernando Merc\u00eas in its November 3 advisory for the new CVE.<\/p>\n\n

\"Diagram
Why the June fix failed, and the management boundary that limits who can reach the vulnerable interface. Simplified from Binarly\u2019s reported findings. MAG212 CYBER original diagram.<\/figcaption><\/figure>\n\n

Why the June fix didn\u2019t work<\/h2>\n\n

Based on Binarly’s findings as summarized by SecurityOnline, dispatcher.cgi<\/code> copies each POST parameter into a fixed buffer without checking the parameter’s size or how many parameters there are. The June fix added checks too late, after the parameter counter had already been corrupted. Patch 3 caps each field at 511 bytes and checks the count before copying anything. GreyNoise reported that attackers took device configurations, network details and hashed credentials.<\/p>\n\n

Is it really exploited?<\/h2>\n\n

The evidence for in-the-wild use of CVE-2026-107441 comes from Binarly. Zyxel’s advisory does not mention exploitation, and CISA’s enrichment on the CVE record still read “Exploitation: none” on November 5. We found no KEV listing for the new CVE. Treat it as exploited anyway: the exploit came from the attackers’ own server and was tested against the June-patched firmware.<\/p>\n\n

Affected models and fixed firmware<\/h2>\n\n
Model<\/th>Firmware code<\/th>Fixed build<\/th><\/tr><\/thead>
GS1900-8<\/td>AAHH<\/td>2.90(AAHH.3)C0<\/td><\/tr>
GS1900-8HP<\/td>AAHI<\/td>2.90(AAHI.3)C0<\/td><\/tr>
GS1900-10HP<\/td>AAZI<\/td>2.90(AAZI.3)C0<\/td><\/tr>
GS1900-16<\/td>AAHJ<\/td>2.90(AAHJ.3)C0<\/td><\/tr>
GS1900-24<\/td>AAHL<\/td>2.90(AAHL.3)C0<\/td><\/tr>
GS1900-24E<\/td>AAHK<\/td>2.90(AAHK.3)C0<\/td><\/tr>
GS1900-24EP<\/td>ABTO<\/td>2.90(ABTO.3)C0<\/td><\/tr>
GS1900-24HPv2<\/td>ABTP<\/td>2.90(ABTP.3)C0<\/td><\/tr>
GS1900-48<\/td>AAHN<\/td>2.90(AAHN.3)C0<\/td><\/tr>
GS1900-48HPv2<\/td>ABTQ<\/td>2.90(ABTQ.3)C0<\/td><\/tr><\/tbody><\/table><\/figure>\n\n

What to do, in order<\/h2>\n\n
  1. Close the door first.<\/strong> Limit web management to an admin VLAN or approved hosts with ACLs. The attacker must be on the switch’s network, so flat school and office networks are the most exposed.<\/li>
  2. Preserve evidence<\/strong> from any switch reachable from user, student, guest or Wi-Fi segments: configuration and logs.<\/li>
  3. Install Patch 3<\/strong> for each model, including switches you patched in June. Zyxel lists no workaround.<\/li>
  4. Change default and reused passwords.<\/strong> If compromise is plausible, reset from a known-good configuration and rotate any credentials the switch held.<\/li>
  5. V\u00e9rifier<\/strong> the firmware string ends in .3)C0<\/code> after reboot, the web UI is unreachable from user VLANs, and trunks, PoE and spanning tree behave normally.<\/li><\/ol>\n\n

    A quick, authorized boundary test from a host on a user or student VLAN (replace the placeholder):<\/p>\n\n

    curl -skI --max-time 5 https:\/\/SWITCH_MGMT_IP\/ ; echo \"exit: $?\"\ncurl -sI  --max-time 5 http:\/\/SWITCH_MGMT_IP\/  ; echo \"exit: $?\"<\/code><\/pre>\n\n
    Exit code 28 (timeout) or 7 (refused) means that segment is blocked; any HTTP status line means it isn’t. Checked against curl documentation; not run against live systems for this article.<\/em><\/p>\n\n
    What to look for<\/h2>\n\n