Zyxel patches second GS1900 flaw after first fix left switches open

Zyxel has shipped a second firmware fix for its GS1900 switches after researchers found the patch for an actively exploited zero-day still left the devices open to unauthenticated root command execution. Zyxel confirmed the new flaw, CVE-2026-107441, and Binarly rates it 9.8 critical.

Zyxel released its fix for the first flaw, CVE-2026-7273, on June 16, 2026. GreyNoise then reported attacks in the wild in September. On September 28, Binarly tested all ten firmware versions Zyxel had offered as fixes and found each one remained vulnerable. The company acknowledged the new flaw on October 11, released a patch on October 22, and posted its advisory on November 3.

The vulnerability sits in dispatcher.cgi, and the same weak code exists in httprestorecfg.cgi and httpupload.cgi. The web page keeps request parameters in a fixed block of 140 slots, each 1,024 bytes. The program writes the data before checking the length. A long value in slot 139 overflows and alters the counter. Setting that counter to a negative value lets an attacker write before the block, overwriting function pointers to execute commands. Zyxel's first patch added a count check, but the unsafe copy still occurs before that check.

Binarly says Zyxel rated the bug 8.8. Binarly scores it 9.8 because the vulnerability sits in global memory rather than the stack, and it can be reached through ordinary HTTP from any network with access to the switch. The result is unauthenticated root command execution.

GreyNoise reported that one actor targeted 996 GS1900 switches in 48 countries around August 17, taking device configurations, hashed root passwords, and network information. Of those, 564 still used factory default passwords. The most affected countries were Italy, the United States, and Taiwan. The attack used a Python script protected with PyArmor, which retrieved a collector over TFTP and saved stolen data in a web-accessible location. GreyNoise connected the actor to the Gitea campaign that Acronis calls Red Heron, based on shared infrastructure and malware. That operation deployed JITTERLY, a Linux backdoor with over 30 commands that conceals the SIXZUT rootkit.

On September 21, CISA placed CVE-2026-7273 on its Known Exploited Vulnerabilities catalog. Binarly states that either the initial fix was flawed, or the exploits targeted another vulnerability than the one CISA listed. Whichever is true, the issue described in Binarly's advisory remains in all ten firmware versions offered as fixes.

Administrators should apply the October 22 release or a later one to every GS1900 switch. Restrict web management pages to trusted admin networks and change all default passwords immediately. CISA recommends checking devices for unusual admin activity, changed settings, and odd web requests. Because attackers captured hashed root credentials, treat exposed switches as compromised and rotate their passwords.