Attackers exploit new Zyxel GS1900 flaw that bypassed earlier fix

A vulnerability in Zyxel GS1900 switches was being exploited even after the June 2026 fix for CVE-2026-7273, CybersecurityNews reported on Wednesday. Zyxel has assigned the separate flaw CVE-2026-107441 with a 9.8 critical CVSS score, and updated firmware for the switch line shipped on October 22.

Binarly researchers found that the public exploit targeted a different flaw from the one Zyxel patched. Zyxel released the CVE-2026-7273 fix on June 16, 2026. After GreyNoise reported live attacks in September, Binarly checked all ten firmware versions that Zyxel had shipped as patches on September 28 and found none of them closed the hole, according to CybersecurityNews. Zyxel stated it confirmed the separate vulnerability on October 11, shipped a patched firmware on October 22, and published the advisory on November 3, according to CybersecurityNews.

According to Binarly, the defect sits in the web program dispatcher.cgi, and the same weak code appears in httprestorecfg.cgi and httpupload.cgi. An unauthenticated attacker can run root commands on the switch. The web interface stores incoming request parameters in a fixed-size block of 140 entries, each 1,024 bytes. Because the code copies data before it validates the count, a long value in slot 139 can overwrite the counter itself. An attacker is able to make the counter negative, write to memory ahead of the block, replace stored function pointers, and then execute arbitrary commands. Zyxel's first patch added a length check, but the copy still happens before the check runs. Binarly says Zyxel described the flaw incorrectly: the buffer sits in global memory rather than on the stack, and the attack does not require HTTPS and can be reached from any network with access to the device. Binarly therefore assigns a higher severity than Zyxel's 8.8.

GreyNoise observed one actor targeting 996 GS1900 devices across 48 countries on about August 17, according to CybersecurityNews. The actor gathered device configurations, hashed root passwords, and network details; 564 of the switches still used factory default credentials. Most victims were in Italy, the United States, and Taiwan. The malicious upload was a Python program protected with PyArmor. It fetched a collector from the attacker's server over TFTP and then placed the stolen data in a web-accessible folder. GreyNoise attributes the attacks to the same actor behind a Gitea exploitation campaign that Acronis calls Red Heron, based on overlapping infrastructure and malware. The Red Heron campaign employed JITTERLY, a Linux backdoor offering over 30 commands and concealing a rootkit named SIXZUT. Binarly identified the samples while examining this server for detections via its Transparency Platform, according to CybersecurityNews.

CISA added CVE-2026-7273 to the Known Exploited Vulnerabilities catalog on September 21, CybersecurityNews reported. Binarly now assesses that the June update was ineffective or that the attackers exploited a distinct flaw from the one CISA listed. In either case, Binarly's documentation shows the flaw remains in all ten firmware versions sold as patched. The same actor also compromised WordPress sites; GreyNoise counted over 18,000 stolen records in one incident.

Administrators should install the October 22 fix or later on every GS1900 switch, keep web management off the internet or limit it to trusted admin networks, immediately change any default passwords, watch for unusual admin activity, altered settings, and strange web requests, and rotate passwords since attackers captured hashed root credentials.