Zyxel switch flaw survived patch and was exploited in attacks

A flaw in Zyxel GS1900 switch firmware, now tracked as CVE-2026-107441, survived a June security update and has been linked to a wave of attacks on around 996 switches across 48 countries. Binarly, in a report published on 3 November, detailed an out-of-bounds write vulnerability in the switches’ web management program that could allow an unauthenticated attacker to execute OS commands with root privileges.

Earlier, researchers tied the activity to CVE-2026-7273, a separate stack-based buffer overflow that Zyxel patched on 16 June; GreyNoise had described exploitation of that flaw in September. CISA subsequently added CVE-2026-7273 to the Known Exploited Vulnerabilities catalogue.

Binarly’s analysis of an obfuscated Python exploit matched the September disclosure and showed that the June fixes left the vulnerable code in all 10 affected firmware releases. Zyxel acknowledged the flaw on 11 October, released a fix on 22 October, and published its security advisory on 3 November. Zyxel lists ten GS1900 models as affected; for example, on the GS1900-8, firmware 2.90(AAHH.2)C0 and earlier are affected while 2.90(AAHH.3)C0 contains the fix.

Zyxel says users should install the updates for optimal protection; Binarly, meanwhile, has argued that the severity and the patch’s effectiveness were misrepresented, noting a higher impact rating and differing assumptions about exploit access.