Zyxel published an advisory on 3 November for CVE-2026-107441, an out-of-bounds write in the CGI program of its GS1900 series switch firmware, and released Patch 3 builds for ten models. The security firm Binarly says the flaw is the one an exploit seen in attacks relied on, and that the exploit worked on all ten builds that carried the June fix for a different CVE.
What Binarly reported
Binarly began by analyzing malware that Acronis researchers had tied to a threat actor exploiting Gitea instances. The malware’s command server hosted an open directory, and one file in it was a bundle holding an exploit for Zyxel GS1900 switches. GreyNoise published a report on 21 September that tied the actor’s exploit to CVE-2026-7273, and Binarly says it focused on findings beyond those publications. They include samples of a backdoor it calls JITTERLY and a rootkit it calls SIXZUT, with command-server addresses and file hashes in an indicator list that defenders can hunt against.
Zyxel’s June 16 advisory for CVE-2026-7273 describes “a stack-based buffer overflow vulnerability in the CGI program” of the GS1900 firmware and lists 2.90 Patch 2 builds as the fix. Binarly compared the Patch 2 code with the code before it and wrote that the CVE-2026-7273 description “does not match what the exploit does.” According to Binarly, the exploit achieves an arbitrary memory write through a global buffer, and the changes in Patch 2 do not stop it. On 28 September Binarly confirmed that all ten Patch 2 releases remained open to the exploit used by the threat actor.
How Zyxel classified it
Binarly reports that Zyxel told it the CVE-2026-7273 flaw was a reqParameters overflow caused by a lack of counter validation, even though the advisory text refers to a stack overflow. Zyxel also considered what Binarly reported to be a separate vulnerability, because Binarly had also pointed to the lack of a parameter size check. Zyxel confirmed the new vulnerability on 11 October and reserved CVE-2026-107441.
Binarly describes the Patch 3 change as two checks: the number of request parameters is now tested before a parameter is copied into the global buffer, and each copied field is limited to 511 bytes. In Binarly’s assessment this closes the flaw the exploit used, which gives owners a concrete reason to treat Patch 3 as a different fix from Patch 2.
Zyxel released the fix on 22 October and published its advisory on 3 November. The advisory describes the flaw as one that “could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.” Binarly’s write-up calls the flaw a pre-authentication remote code execution issue. The Zyxel advisory lists no workaround.
The timeline
- 16 June: Zyxel publishes its advisory for CVE-2026-7273.
- 21 September: GreyNoise ties the actor’s exploit to CVE-2026-7273, and CISA adds CVE-2026-7273 to its Known Exploited Vulnerabilities catalog, according to Binarly’s timeline.
- 28 September: Binarly confirms all ten fixed releases remain vulnerable to the exploit.
- 29 September: Binarly notifies Zyxel’s PSIRT.
- 22 October: Zyxel releases the fix for CVE-2026-107441.
- 3 November: Zyxel and Binarly publish advisories.
What it means for the security leader
The affected builds are listed model by model. Zyxel’s table names 2.90(AAHH.2)C0 and earlier for the GS1900-8, with 2.90(AAHH.3)C0 as the fix, and follows the same pattern for the GS1900-8HP, 10HP, 16, 24, 24E, 24EP, 24HPv2, 48 and 48HPv2. A switch running Patch 2 meets the earlier advisory’s requirement, so a version check against the June advisory alone would have reported it as fixed.
Binarly’s authors state the lesson in the conclusion of their write-up: “Advisories and version numbers certainly help, but they cannot be blindly trusted,” wrote researchers Fernando Mercês and Yegor Vasilenko of Binarly. Their argument is that binary analysis is the dependable way to assess a component, which is their product category, so a buyer should weigh that source accordingly. The factual part is independent of the pitch: a closed ticket tied to one CVE does not show that every path to the same function is closed.
Neither the Zyxel advisory nor Binarly says that switches running Patch 2 were attacked after the June fix. GreyNoise tied the exploit to CVE-2026-7273, and the Zyxel advisory for CVE-2026-107441 does not say whether the new flaw has been used in attacks. Owners should check what happened on devices that carried either build.
What to do
- Inventory every GS1900 switch and record its firmware build, using the model table in the Zyxel advisory.
- Schedule the Patch 3 build for each model. The advisory lists no workaround, so the update is the control.
- Take the web management interface off any network a user or guest device can reach, and limit it to a management VLAN or jump host.
- Review switch configuration and administrator credentials for unexpected changes since the June advisory, and compare network logs against the hostnames and file hashes in Binarly’s indicator list.
- Add the CVE-2026-107441 advisory to the exposure register next to CVE-2026-7273, so a scanner finding for one cannot close the other.
Switches are rarely the first thing on a patch dashboard. In our reading, that makes a management plane reachable from a flat network a convenient place for an attacker to settle, and a closed ticket should prompt a second question about whether the fix covered the path an attacker used. We reported the same pressure on management consoles when Palo Alto Networks updated PAN-OS for a management interface flaw, and the broader management-plane gap in a 20-year-old IPMI flaw leaking a password hash.
Source: Zyxel, advisory for CVE-2026-107441; Binarly, Pre-Auth RCE in Zyxel GS1900 Exploited in the Wild as a Zero-Day
