Zyxel Switch Patch Missed Flaw Behind Wave of Attacks
Researchers at Binarly discovered that Zyxel GS1900 network switches, which had received an earlier fix for an actively exploited flaw, remain vulnerable to the same exploit used by attackers.
Zyxel GS1900 network switches that received the vendor's earlier fix for an actively exploited flaw are still open to the exploit attackers used, researchers at Binarly found.
On September 21, GreyNoise reported that an attacker had exploited that flaw against 996 Zyxel GS1900 switches in 48 countries, taking switch configurations, hashed root credentials and networking information.
Zyxel GS1900 series network switches that received a fix for a flaw that was later reported to have been exploited in the wild are still open to an exploit attackers used, Binarly found .
The US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-7273 to its Known Exploited Vulnerabilities (KEV) catalog the same day.
Either the June patch, its description and its Common Vulnerability Scoring System (CVSS) score were incorrect, or the attacks used a different flaw and CISA's link to CVE-2026-7273 would be wrong.
Zyxel GS1900 has patched a zero-day vulnerability in its GS1900 series network switches that hackers exploited to compromise nearly 1,000 devices worldwide and steal configuration files and credentials.
Zyxel GS1900 rates CVE-2026-107441 at 8.8 and says an attacker must be on the local network to exploit the vulnerability, while Binarly rates it 9.8 and says exploitation requires only network access to the switch's management service.
The vulnerability, tracked as CVE-2026-107441, is an out-of-bounds write flaw in the switches' web management interface that allows an unauthenticated attacker with network access to execute operating system commands using specially crafted HTTP requests.
Either the Patch 2 update was a faulty fix for CVE-2026-7273, or the attacks exploited a different flaw from the one CISA listed, and the vulnerability now carries a new identifier, CVE-2026-107441.
The attacks had originally been tied to CVE-2026-7273, which Zyxel fixed on June 16 and described as a stack-based buffer overflow in the same program, rated 8.8.
What happened
Researchers at Binarly discovered that Zyxel GS1900 network switches, which had received an earlier fix for an actively exploited flaw, remain vulnerable to the same exploit used by attackers.
On September 21, GreyNoise reported that an attacker had exploited this flaw against 996 Zyxel GS1900 switches across 48 countries, compromising switch configurations, hashed root credentials, and networking information.
What changed
Binarly found that Zyxel GS1900 series network switches, despite receiving a fix for a flaw later reported to be exploited in the wild, are still susceptible to an exploit utilized by attackers.
On the same day, the US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-7273 to its Known Exploited Vulnerabilities (KEV) catalog.
Who is affected
The June patch, its description, and its Common Vulnerability Scoring System (CVSS) score may have been incorrect, or the attacks could have utilized a different flaw, making CISA's link to CVE-2026-7273 potentially erroneous.
Zyxel GS1900 has addressed a zero-day vulnerability in its GS1900 series network switches that hackers exploited to compromise nearly 1,000 devices globally and steal configuration files and credentials.
Why it matters
Zyxel rates CVE-2026-107441 at 8.8 and asserts that an attacker must be on the local network to exploit the vulnerability, while Binarly rates it at 9.8, indicating that only network access to the switch's management service is necessary for exploitation.
Tracked as CVE-2026-107441, the vulnerability is an out-of-bounds write flaw in the switches' web management interface, allowing an unauthenticated attacker with network access to execute operating system commands via specially crafted HTTP requests.
Technical details
The Patch 2 update may have been a faulty fix for CVE-2026-7273, or the attacks could have exploited a different flaw, now identified as CVE-2026-107441.
Originally, the attacks were associated with CVE-2026-7273, which Zyxel fixed on June 16 and described as a stack-based buffer overflow in the same program, rated 8.8.
Response
The new 2.90 Patch 3 firmware addresses a flaw now tracked as CVE-2026-107441, which the exploit relies upon.
Zyxel informed researchers that CVE-2026-7273 pertains to the missing counter check, and treats the missing size check as a separate flaw, now designated CVE-2026-107441.
What security teams should do
On September 21, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-7273 to its Known Exploited Vulnerabilities (KEV) catalog, giving federal agencies until September 24 to apply the vendor's fix, the Patch 2 firmware.
While investigating Red Heron infrastructure linked to the JITTERLY backdoor and SIXZUT rootkit, Binarly researchers uncovered an exposed archive containing an obfuscated Python exploit targeting Zyxel GS1900 switches.
Attribution
Infosecurity Magazine: Firmware security company Binarly detailed the finding in research published on November 3, linking it to an exploit that threat intelligence firm GreyNoise had described in September .
Help Net Security: Zyxel GS1900 series network switches that received a fix for a flaw that was later reported to have been exploited in the wild are still open to an exploit attackers used, Binarly found .
The Hacker News: Zyxel GS1900 network switches that received the vendor's earlier fix for an actively exploited flaw are still open to the exploit attackers used, researchers at Binarly found.
BleepingComputer: Zyxel has patched a zero-day vulnerability in its GS1900 series network switches that hackers exploited to compromise nearly 1,000 devices worldwide and steal configuration files and credentials.
What to watch next
Watch for new exploitation reports and updated indicators of compromise.
Watch for updated vendor guidance and fixed-version details.