CVE-2026-107441
CVSS 8.8 HIGH: an out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0… EPSS 0.3% (22nd percentile).
Vulnerabilities · 18h ago
Binarly has tied the exploit behind GreyNoise’s report of 996 compromised Zyxel GS1900 switches around August 17 to CVE-2026-107441, not the June-fixed CVE-2026-7273; the devices spanned 48 countries. Zyxel’s model-specific 2.90 Patch 3 fixes the separately tracked flaw, which remains present across all ten Patch 2 releases.
Binarly found that Patch 2’s added safety check ran only after the unsafe memory copy, so the exploit still worked on every Patch 2 build. A crafted request to the web management interface can write beyond allocated memory, letting an unauthenticated attacker with network access run operating-system commands. GreyNoise says attackers collected device configurations, network information, and hashed root credentials.
For networks with affected switches, Patch 3 closes the reported code-execution path, but stolen network maps and hashed credentials outlive the firmware change. Whether attackers can use them for follow-on access remains unknown.
CVSS 8.8 HIGH: an out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0… EPSS 0.3% (22nd percentile).
7 sources covering this story
Zyxel Switch Patch Missed Flaw Behind Wave of Attacks
Zyxel’s June GS1900 patch did not block the exploit used against 996 switches, Binarly found
Kwetsbaarheid verholpen in Zyxel product
Zyxel heeft een kwetsbaarheid verholpen in de firmware van de Zyxel GS1900-24E netwerk switch, specifiek in versie 2.90(AAHK.2)C0 en eerder.
Zyxel GS1900 series switches that received a fix for CVE-2026-7273 are still open to an exploit attackers used.
Zyxel Switch Hacks Blamed on Patched Flaw Actually Exploited a Zero-Day
Tracked as CVE-2026-107441, the out-of-bounds write flaw could allow attackers to execute OS commands via crafted HTTP requests.
Zyxel patches a zero-day hiding behind an old fix
Attackers exploited a previously unknown flaw in GS1900 switches despite an earlier security update, compromising nearly 1000 devices across 48 countries.
Zyxel GS1900 Patch Fails to Block Zero-Day Exploit Allowing Root Command Execution
Zyxel fixes a GS1900 flaw that allows unauthenticated command execution after researchers show an earlier patch fails to block the exploit.
Zyxel fixes zero-day exploited to hack nearly 1,000 network switches
Zyxel has patched a zero-day vulnerability in its GS1900 series network switches that hackers exploited to compromise nearly 1,000 devices worldwide and steal configuration files and credentials.
Part of the PlainSec briefing for 2026-11-06