Vulnerabilities & Exploits · Zero-Day Exploit

Zyxel GS1900 Patch 2 missed the exploited flaw

Binarly has tied the exploit behind GreyNoise’s report of 996 compromised Zyxel GS1900 switches around August 17 to CVE-2026-107441, not the June-fixed CVE-2026-7273; the devices spanned 48 countries. Zyxel’s model-specific 2.90 Patch 3 fixes the separately tracked flaw, which remains present across all ten Patch 2 releases.

Binarly found that Patch 2’s added safety check ran only after the unsafe memory copy, so the exploit still worked on every Patch 2 build. A crafted request to the web management interface can write beyond allocated memory, letting an unauthenticated attacker with network access run operating-system commands. GreyNoise says attackers collected device configurations, network information, and hashed root credentials.

For networks with affected switches, Patch 3 closes the reported code-execution path, but stolen network maps and hashed credentials outlive the firmware change. Whether attackers can use them for follow-on access remains unknown.

7 sources · Nov 5

CVE-2026-107441

NVD KEV

CVSS 8.8 HIGH: an out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0… EPSS 0.3% (22nd percentile).

Timeline

Nov 5 Reported by Infosecurity Magazine
Nov 4 Reported by BleepingComputer

Sources

Nov 5 Infosecurity Magazine
Zyxel Switch Patch Missed Flaw Behind Wave of Attacks
Zyxel’s June GS1900 patch did not block the exploit used against 996 switches, Binarly found
original
Nov 5 NCSC-NL Advisories
Kwetsbaarheid verholpen in Zyxel product
Zyxel heeft een kwetsbaarheid verholpen in de firmware van de Zyxel GS1900-24E netwerk switch, specifiek in versie 2.90(AAHK.2)C0 en eerder.
original
Nov 5 Help Net Security
Patched Zyxel GS1900 switches remained open to in-the-wild exploit (CVE-2026-107441) - Help Net Security
Zyxel GS1900 series switches that received a fix for CVE-2026-7273 are still open to an exploit attackers used.
original

Part of the PlainSec briefing for 2026-11-05

Every edition of this story: Zyxel GS1900 Patch 2 missed the exploited flaw

More from today

Vulnerabilities & Exploits · Zero-Day ExploitZyxel GS1900 Patch 2 missed the exploited flawBinarly has tied the exploit behind GreyNoise’s report of 996 compromised Zyxel GS1900 switches around August 17 to CVE-2026-107441, not the June-fixed CVE-2026-7273; the devices spanned 48 countries. Zyxel’s model-specific 2.90 Patch 3 fixes the separately tracked flaw, which remains present across all ten Patch 2 releases.Binarly found that Patch 2’s added safety check ran only after the unsafe memory copy, so the exploit still worked on every Patch 2 build. A crafted request to the web management interface can write beyond allocated memory, letting an unauthenticated attacker with network access run operating-system commands. GreyNoise says attackers collected device configurations, network information, and hashed root credentials.For networks with affected switches, Patch 3 closes the reported code-execution path, but stolen network maps and hashed credentials outlive the firmware change. Whether attackers can use them for follow-on access remains unknown.7 sources · Nov 5

CVE-2026-107441

NVD KEV

CVSS 8.8 HIGH: an out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0… EPSS 0.3% (22nd percentile).

Timeline

Nov 5 Reported by Infosecurity Magazine

Nov 4 Reported by BleepingComputer

Sources

Nov 5 Infosecurity Magazine

Zyxel Switch Patch Missed Flaw Behind Wave of Attacks

Zyxel’s June GS1900 patch did not block the exploit used against 996 switches, Binarly found

original

Nov 5 NCSC-NL Advisories

Kwetsbaarheid verholpen in Zyxel product

Zyxel heeft een kwetsbaarheid verholpen in de firmware van de Zyxel GS1900-24E netwerk switch, specifiek in versie 2.90(AAHK.2)C0 en eerder.

original

Nov 5 Help Net Security

Patched Zyxel GS1900 switches remained open to in-the-wild exploit (CVE-2026-107441) - Help Net Security

Zyxel GS1900 series switches that received a fix for CVE-2026-7273 are still open to an exploit attackers used.

original

Part of the PlainSec briefing for 2026-11-05Every edition of this story: Zyxel GS1900 Patch 2 missed the exploited flawMore from today

WordPress upgrade window opens a path to server code

PHP2Shell chain now reaches root on firewalls

Drupal Commerce Core authorization flaw is actively exploited