Zyxel GS1900 Zero-Day CVE-2026-107441 Exploited in the Wild, Bypassing Earlier Patch
Do Son 
TL;DR
Attackers used a Zyxel GS1900 zero-day, now tracked as CVE-2026-107441, to break into network switches that admins believed were patched. Binarly researchers Fernando Mercês and Yegor Vasilenko found the flaw while studying an exploit left on an attacker’s server. Zyxel’s June fix for a related bug, CVE-2026-7273, did not stop it.
CVE-2026-107441 is an out-of-bounds write in the GS1900 web interface. It lets an unauthenticated attacker on the adjacent network run OS commands. The exploit used in real attacks works on firmware that carries the CVE-2026-7273 fix. Zyxel released new firmware on October 22, and owners should install it now.
- Product: Zyxel (2 products)
- Vulnerabilities: 2 flaws (CVE-2026-107441, CVE-2026-7273)
- Highest severity: 8.8 (High · CVSSv3)
- Status: Exploited in the wild
- Exploit Intel (PatchThis): 1 of 2 confirmed
- Action: See vendor advisories
| CVE | CVSS (CVSSv3) | Type | Status |
|---|---|---|---|
| CVE-2026-107441 | 8.8 | CWE-787 | Exploited in the wild |
| CVE-2026-7273 | 8.8 | CWE-121 | Exploited in the wild |
Why It Matters
This flaw has been exploited in the wild against real devices. In September, GreyNoise reported that an attacker stole data from 996 GS1900 switches in 48 countries. Help Net Security said the attacks began on or about August 17, and the stolen data included configurations and hashed root credentials. GreyNoise tied those attacks to CVE-2026-7273. CISA then added that CVE to its Known Exploited Vulnerabilities catalog on September 21.
However, Binarly found that the exploit targets a different bug. Its configuration even lists addresses for “the patched firmware for Zyxel GS1900-24 switch.” As Binarly puts it, “the latest firmware version released as a fix to CVE-2026-7273 is vulnerable to the same exploit, which works without changes.”
That means the CISA alert gave owners false comfort. Zyxel told Binarly that CVE-2026-7273 covered a missing counter check, even though its advisory described a stack overflow. It treats the missing parameter size check as a separate flaw, now CVE-2026-107441. In Binarly’s words, “because the threat actor was exploiting a different vulnerability, and patch for CVE-2026-7273 remained ineffective, this had no effect on protecting devices from being exploited by this threat actor.”
How the Attack Works
The bug lives in dispatcher.cgi, which handles HTTP POST requests on the switch’s web server. The program copies each request parameter into a fixed global buffer. However, it never checks the size of each parameter or how many parameters arrive.
Binarly explains that an attacker “can send a crafted request that will cause a memory corruption bug and allow writing to a wide address range within the process memory.” The exploit uses that write to redirect program execution and run commands. Notably, the earlier patch added checks too late, after the parameter counter was already corrupted.
How Binarly found it
Binarly was tracking JITTERLY, a Linux backdoor that drops the SIXZUT rootkit, after Acronis TRU linked it to Gitea attacks. The malware’s command server hosted an open directory. Inside sat an obfuscated Python exploit labeled “Zyxel GS1900 Pre-Auth RCE.” Binarly believes “the exploit is LLM-generated.” The researchers also tested it on real hardware and plan to release a minimized proof-of-concept later.
Affected Versions
According to the CVE record, CVE-2026-107441 carries a CVSS 3.1 score of 8.8. It affects firmware through 2.90(xxxx.2)C0 on these models:
- GS1900-8, GS1900-8HP and GS1900-10HP
- GS1900-16, GS1900-24, GS1900-24E and GS1900-24EP
- GS1900-24HPv2, GS1900-48 and GS1900-48HPv2
In short, the “.2” builds that fixed CVE-2026-7273 remain vulnerable to this Zyxel GS1900 zero-day.
Patch and Mitigation
- Install the firmware Zyxel released on October 22 for your GS1900 model.
- Keep the switch web interface off untrusted networks and limit it to a management VLAN.
- Change factory default credentials. GreyNoise found that 564 victims still used them.
- Treat any switch exposed before patching as potentially compromised.
Binarly confirms that the new code fixes the bug. It now limits each copied field to 511 bytes and checks the parameter count before copying.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
