Binarly finds Zyxel GS1900 switches remain open to root exploits

Zyxel GS1900 network switches that were patched with the earlier remedy for an actively exploited flaw remain susceptible to the zero-day attackers used, researchers from Binarly have found. The exploit allows unauthenticated, network‑reachable access to a switch’s web management interface to execute root commands. Zyxel issued a firmware update to 10 GS1900 models, replacing the prior Patch 2 release (2.90 Patch 2) with Patch 3 to fix a separate flaw tracked as CVE-2026-107441. The advisory from Zyxel states Patch 3 mitigates this issue, and the researchers note the zero-day was being exploited even before Patch 3 was released.

Evidence tying the attacks to CVE-2026-7273 surfaced through GreyNoise’s September data, which tracked activity on 996 GS1900 switches around mid‑August and linked it to CVE-2026-7273; Binarly confirms the exploit observed matches that activity. Patch 2’s fix reportedly addressed the missing counter check but did not prevent exploitation, according to Binarly, which assigns CVE-2026-7273 to the counter‑check flaw and CVE-2026-107441 to the separate flaw now addressed by Patch 3.

Zyxel’s advisory lists affected and fixed firmwares per model, including GS1900-8, GS1900-8HP, GS1900-10HP, GS1900-16, GS1900-24, GS1900-24E, GS1900-24EP, GS1900-24HPv2, GS1900-48, and GS1900-48HPv2, with Patch 3 replacing Patch 2 for all. The U.S. CISA KEV listing added CVE-2026-7273 to its exploited catalog on 21 September, with federal deadlines tied to Patch 2; the KEV entry for CVE-107441 was not confirmed at the time of reporting.

The attacks reportedly included data theft of switch configurations, hashed root credentials, and network information, with many devices still using factory defaults.