MAG212 CYBER ORIGINAL ARTICLE

Zyxel GS1900 Zero-Day CVE-2026-107441: Why the June Patch Didn’t Hold, and Which Firmware Fixes It

November 5, 2026 · El Mostafa Ouchen

In August, attackers compromised close to 1,000 Zyxel GS1900 switches. The attacks were blamed on CVE-2026-7273, a flaw Zyxel had fixed in June. Now Binarly says the attackers’ own exploit still worked on the June-patched firmware. Zyxel has assigned a new CVE, CVE-2026-107441, and released 2.90 Patch 3. If you patched in June, you need to patch again.

Key facts

Item	Detail
CVE	CVE-2026-107441, out-of-bounds write (CWE-787) in the switch CGI program
Score	CVSS 3.1 8.8 (Zyxel, CNA); vector AV:A, adjacent network, no login
Affected	Ten GS1900 models on 2.90(xxxx.2)C0 or earlier
Fix	2.90(xxxx.3)C0 (“Patch 3”); no workaround
Advisory	Zyxel, November 3, 2026; Patch 3 announced October 23
Exploitation	In the wild according to Binarly; Zyxel’s advisory does not say; not found in CISA KEV

What happened

GreyNoise documented the campaign in September: 996 compromised switches in 48 countries from about August 17, 564 of them still using default passwords. CISA added CVE-2026-7273 to its Known Exploited Vulnerabilities catalog on September 21. The fix for that flaw had shipped in June.

Binarly then recovered the attackers’ exploit, exp.py, from an open directory on their command server. It targets /cgi-bin/dispatcher.cgi. According to Binarly, it still ran commands without authentication on all ten firmware builds that carried the June fix. Zyxel credited Binarly researchers Yegor Vasilenko and Fernando Mercês in its November 3 advisory for the new CVE.

Why the June fix failed, and the management boundary that limits who can reach the vulnerable interface. Simplified from Binarly’s reported findings. MAG212 CYBER original diagram.

Why the June fix didn’t work

Based on Binarly’s findings as summarized by SecurityOnline, dispatcher.cgi copies each POST parameter into a fixed buffer without checking the parameter’s size or how many parameters there are. The June fix added checks too late, after the parameter counter had already been corrupted. Patch 3 caps each field at 511 bytes and checks the count before copying anything. GreyNoise reported that attackers took device configurations, network details and hashed credentials.

Is it really exploited?

The evidence for in-the-wild use of CVE-2026-107441 comes from Binarly. Zyxel’s advisory does not mention exploitation, and CISA’s enrichment on the CVE record still read “Exploitation: none” on November 5. We found no KEV listing for the new CVE. Treat it as exploited anyway: the exploit came from the attackers’ own server and was tested against the June-patched firmware.

Affected models and fixed firmware

Model	Firmware code	Fixed build
GS1900-8	AAHH	2.90(AAHH.3)C0
GS1900-8HP	AAHI	2.90(AAHI.3)C0
GS1900-10HP	AAZI	2.90(AAZI.3)C0
GS1900-16	AAHJ	2.90(AAHJ.3)C0
GS1900-24	AAHL	2.90(AAHL.3)C0
GS1900-24E	AAHK	2.90(AAHK.3)C0
GS1900-24EP	ABTO	2.90(ABTO.3)C0
GS1900-24HPv2	ABTP	2.90(ABTP.3)C0
GS1900-48	AAHN	2.90(AAHN.3)C0
GS1900-48HPv2	ABTQ	2.90(ABTQ.3)C0

What to do, in order

Close the door first. Limit web management to an admin VLAN or approved hosts with ACLs. The attacker must be on the switch’s network, so flat school and office networks are the most exposed.
Preserve evidence from any switch reachable from user, student, guest or Wi-Fi segments: configuration and logs.
Install Patch 3 for each model, including switches you patched in June. Zyxel lists no workaround.
Change default and reused passwords. If compromise is plausible, reset from a known-good configuration and rotate any credentials the switch held.
Verify the firmware string ends in .3)C0 after reboot, the web UI is unreachable from user VLANs, and trunks, PoE and spanning tree behave normally.

A quick, authorized boundary test from a host on a user or student VLAN (replace the placeholder):

curl -skI --max-time 5 https://SWITCH_MGMT_IP/ ; echo "exit: $?"
curl -sI  --max-time 5 http://SWITCH_MGMT_IP/  ; echo "exit: $?"

Exit code 28 (timeout) or 7 (refused) means that segment is blocked; any HTTP status line means it isn’t. Checked against curl documentation; not run against live systems for this article.

What to look for

HTTP POSTs to switch management addresses from non-admin hosts.
TFTP transfers and unusual outbound connections from switches.
Running configurations that differ from backups: new admin accounts, VLAN or port changes nobody ticketed.

Legitimate provisioning can look similar, so match changes to tickets before escalating. Victims’ firmware versions have not been reported.

Frequently asked questions

I patched my GS1900 switches in June. Am I safe?

No. According to Binarly, the attackers’ exploit still worked on June-patched firmware. Install 2.90 Patch 3.

Can this be exploited from the internet?

Zyxel’s CVSS vector is adjacent-network: the attacker needs to reach the switch on its local network. A switch whose management interface is exposed more widely is at greater risk.

Is there a workaround?

Zyxel lists none. Restricting management access reduces exposure, but installing Patch 3 is the fix.

Read today’s full MAG212 CYBER Daily (free) →

Subscribe free