Zyxel's patch missed the switch flaw attackers were exploiting

Zyxel GS1900 switches that were patched against an actively exploited flaw in June remained open to the same attacks until a second fix in late October, according to research from Binarly. The exploit that attackers used, which researchers had tied to CVE-2026-7273, abuses a different bug that the June firmware did not fix. It is now tracked as CVE-2026-107441.

Binarly says the exploit it recovered even contains memory addresses for 2.90(AAHL.2)C0, the GS1900-24 firmware Zyxel released in June with release notes saying it fixed CVE-2026-7273. When Binarly tested the exploit against that firmware, it worked without changes.

One flaw, two descriptions

Zyxel described CVE-2026-7273 as a stack-based buffer overflow. Binarly found that the exploit instead overflows a global buffer that holds the parameters of a web request in the switch's dispatcher.cgi program, then overwrites the counter that tracks them, giving the attacker a write to almost any address. The June firmware added checks on that counter, but only after the copy that corrupts it, so they never take effect.

When Binarly reported this, Zyxel said CVE-2026-7273 had been about that buffer all along, despite the stack overflow wording, and treated the missing size check as a separate flaw, Binarly says. Zyxel released new firmware on 22 October and published its advisory for CVE-2026-107441 on 3 November. The advisory lists ten GS1900 models, says an unauthenticated attacker on the local network could run operating system commands, and does not say the flaw has been exploited or mention CVE-2026-7273.

Who was attacked

GreyNoise reported in September that a Chinese group it believes is the same as, or closely related to, Red Heron compromised 996 GS1900 switches in 48 countries in August, taking hashed root credentials and configuration data, and in one case more than 18,000 records from a Western government organisation, SecurityWeek reported. CISA added CVE-2026-7273 to its Known Exploited Vulnerabilities catalogue on 21 September with a three-day deadline for federal agencies. The firmware that met that deadline did not stop the exploit.

Binarly found the Zyxel exploit on a command-and-control server for the JITTERLY backdoor and its SIXZUT rootkit, the malware Acronis had linked to attacks on Gitea servers. CVE-2026-107441 was not in CISA's catalogue on 4 November.

What to do

Install the firmware ending in .3 from Zyxel's advisory, such as 2.90(AAHL.3)C0 for the GS1900-24, even on switches already updated for CVE-2026-7273. The attack needs network access to the switch's web interface, so keep management interfaces off user and guest networks. GreyNoise found that 564 of the compromised switches still had factory default credentials, which are worth changing as well.