Binarly warns of exploited Zyxel GS1900 switch zero day

A Zyxel GS1900 zero‑day has been exploited in the wild, researchers from Binarly warn. The flaw, tracked as CVE-2026-107441, is an out‑of‑bounds write in the GS1900 web interface’s dispatcher.cgi that lets an unauthenticated attacker on the adjacent network run OS commands. Binarly says the exploit targets firmware still vulnerable despite Zyxel’s patch for a related bug, CVE-2026-7273, released in June. Zyxel issued a further firmware update on 22 October 2026, and users are advised to apply it.

The CVE records show CVSS v3.1 scores of 8.8 for both CVE-2026-107441 and CVE-2026-7273, with the former described as a stack/memory corruption issue that enables a wide‑scope write and code execution.

Zyxel GS1900‑series devices affected by CVE‑2026‑107441 include the GS1900‑8, GS1900‑8HP, GS1900‑10HP, GS1900‑16, GS1900‑24, GS1900‑24E, GS1900‑24EP, GS1900‑24HPv2, GS1900‑48 and GS1900‑48HPv2, up to firmware 2.90(xxxx.2)C0. In practical terms, Binarly notes the exploit can still succeed on devices even when the CVE-7273 patch is present, because that patch addressed a missing counter check rather than the underlying parameter‑size validation now CVE-107441.

Confirmed exploit activity is described by GreyNoise and Help Net Security as having impacted thousands of switches across numerous countries, underscoring the need for immediate patching, credential hygiene and restricting web interfaces to trusted networks. Zyxel confirms the new code fixes the bug by implementing a 511‑byte per field limit and parameter‑count checks.