Vulnerability in Zyxel GS1900 Switch Firmware Exposes Risks Despite Patch Efforts
A significant security vulnerability has been discovered in the firmware of Zyxel GS1900 switches, continuing to pose potential risks despite a security update issued in June. This revelation raises critical questions regarding the effectiveness of the update, which was intended to address vulnerabilities that have already been exploited in attacks against 996 switches across 48 nations.
On November 3, firmware security company Binarly published research uncovering this issue. The findings were linked to an exploit previously documented by threat intelligence firm GreyNoise in September, further complicating the ongoing assessments of the vulnerabilities in question. The vulnerability in the firmware has now been assigned a new identifier: CVE-2026-107441. This specific flaw is categorized as an out-of-bounds write vulnerability in the switches’ web management interface, enabling unauthenticated attackers to execute operating system (OS) commands with root privileges—a serious security risk for any affected network infrastructure.
Initially, the attacks were traced back to CVE-2026-7273, a vulnerability that Zyxel addressed with a patch issued on June 16. This issue, characterized as a stack-based buffer overflow in the same management program used by the switches, was rated an 8.8 on the Common Vulnerability Scoring System (CVSS) scale. On September 21, GreyNoise not only confirmed that attackers had successfully exploited this specific flaw but also detailed the consequences: the theft of switch configurations, hashed root credentials, and networking information from the impacted devices.
In response to the alarming nature of these exploits, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) promptly included CVE-2026-7273 in its catalog of Known Exploited Vulnerabilities (KEV).
Persistent Vulnerability Following June Update
Further analysis by Binarly indicated that an obfuscated Python exploit matched the description provided by GreyNoise. On September 28, researchers validated their findings by confirming that all ten firmware versions released as part of the June patch were still susceptible to exploitation.
According to Binarly, while the June update introduced a precautionary check, this check occurred only after an unsafe copy had already taken place. The analysts asserted that this change failed to resolve the underlying vulnerability, thereby undermining the integrity of the claimed patch.
Binarly provided two possible explanations for the oversight: either the June patch and its associated description—along with the CVSS rating—were erroneous, or the exploitation of the attacks utilized a distinct flaw, rendering CISA’s connection to CVE-2026-7273 inaccurate. Regardless of the explanation, Binarly emphasized that all ten firmware releases marketed as fixes retained the exposed and vulnerable code.
Severity Ratings and Subsequent Firmware Response
As the situation unfolded, a discrepancy arose regarding the severity of the vulnerability. Zyxel rated CVE-2026-107441 at 8.8, requiring an attacker to be present on the local network for exploitation. Conversely, Binarly rated the vulnerability significantly higher, at 9.8, asserting that exploitation only necessitated access to the management service of the switch without the need for local network presence.
Binarly reported notifying Zyxel about the flaw on September 29. Zyxel acknowledged the issue on October 11 and subsequently released a fix on October 22, which was communicated to users shortly afterward in an advisory on November 3.
The flawed firmware affects a total of ten models within the GS1900 range. For instance, the GS1900-8 model is impacted by firmware version 2.90(AAHH.2)C0 and earlier, while version 2.90(AAHH.3)C0 includes the necessary fix. Zyxel encouraged users to implement the updates promptly, indicating that this would provide “optimal protection.” Furthermore, its advisory highlighted that the previously issued June releases are also among the affected versions, underlining the necessity for any switches updated during that timeframe to receive the new firmware.
In conclusion, the ongoing vulnerability in Zyxel’s GS1900 switches serves as a critical reminder of the complexities associated with network security and the importance of timely and effective patch management to safeguard against potential exploits. As organizations increasingly rely on digital infrastructure, maintaining robust cybersecurity protocols becomes imperative for protecting sensitive information and ensuring operational integrity.