Zyxel fixes bypassed flaw in GS1900 switches with Patch 3

Zyxel has issued Patch 3 for 10 GS1900 switch models to fix a zero‑day flaw now tracked as CVE-2026-107441. The vulnerability, described as an out‑of‑bounds write in the dispatcher.cgi handling the web management interface, allows an unauthenticated remote attacker to run commands with root privileges. The patch follows an earlier fix for CVE-2026-7273, a stack‑based buffer overflow in the same CGI program that Zyxel disclosed in June 2026 and which CISA later added to KEV.

Binarly’s analysis shows that exploitation in the wild began around August 2026, with data exfiltration targeting 996 GS1900 switches across 48 countries, and the activity is linked to CVE-2026-7273. The new Patch 3 addresses a separate weakness—an unchecked parameter size that Patch 2 did not fully close—by adding a pre‑copy counter check to prevent overflows.

The vulnerability stems from how dispatcher.cgi copies HTTP request parameters into a fixed area designed for 140 parameters, without properly limiting parameter size or count before Patch 2. The result is that an oversized 140th parameter can overflow the buffer, overwriting the parameter counter and redirecting execution to attacker‑chosen commands. Patch 3 mitigates this by validating the counter and copy size beforehand.

Zyxel’s advisory lists the affected models and firmware ranges, noting that on‑market products not listed are unaffected, and that Patch 3 was posted on 23 October 2026. Exfiltrated data reportedly included switch configurations, hashed root credentials, and network information; 564 of the 996 affected devices still used factory‑default credentials.

The article advises upgrading to Patch 3, restricting the management interface, replacing default credentials, reviewing configurations, and planning for potential hidden compromise.