Zyxel published an advisory on November 3 for CVE-2026-107441, an out-of-bounds write in the CGI program of GS1900-series managed switches. Binarly’s analysis shows it is the bug actually used in the campaign that compromised nearly 1,000 switches, and that the exploit works against firmware that was already patched for the earlier CVE-2026-7273. The attacks had been attributed to the older, supposedly fixed flaw.

What happened

CVE-2026-7273, a stack-based buffer overflow in the GS1900 web CGI (CVSS 8.8), was disclosed and patched on June 16. Exploitation was observed from mid-August. CISA added it to the Known Exploited Vulnerabilities catalog in September, and GreyNoise reported a suspected Chinese-speaking actor had compromised 996 switches across 48 countries and exfiltrated configurations and credentials.

Binarly’s timeline shows the problem went beyond unpatched devices:

  • September 28: Binarly confirmed the in-the-wild exploit still worked against all ten firmware releases that were patched for CVE-2026-7273.
  • September 29: Binarly reported the finding to Zyxel.
  • October: Zyxel confirmed a distinct flaw, now CVE-2026-107441.
  • Late October (reports say October 22 or 23): Fixed firmware shipped.
  • November 3: Zyxel published its advisory.

Technical details

CVE-2026-107441 is an out-of-bounds write in the same CGI component. Per Binarly, the earlier patch added bounds checks, but an attacker can corrupt a parameter counter before those checks run, so the validation operates on attacker-controlled state and the write goes through. Binarly reports this leads to command execution as root on the switch.

The two vendors disagree on exposure and severity. Zyxel scores the flaw 8.8 and describes a LAN-adjacent attacker. Binarly rates it 9.8 and describes a remote attacker. In practice, any switch whose web management interface is reachable from an untrusted network should be treated as exposed. Reports note the exploit requires network reachability to the management service and no valid credentials.

Impact

Ten GS1900 models are affected, including the GS1900-8, GS1900-8HP and GS1900-10HP. Zyxel states currently marketed products outside its advisory table are not affected. The switches sit in the middle of campus, branch and OT-adjacent networks, so a root shell gives an attacker:

  • Running and startup configuration, including VLAN layout, SNMP communities and stored credentials.
  • A persistent foothold with visibility into traffic on adjacent segments.
  • A pivot point that most EDR and log pipelines never cover.

The campaign’s earlier reporting attributed activity to a suspected Chinese-speaking actor. Binarly links the zero-day to that same activity, but this attribution is not independently confirmed.

Mitigation

  1. Upgrade every GS1900 switch to the newest firmware listed in Zyxel’s advisory. One report gives the fixed build as the 2.90 train, release “.3”. Being on a build that fixed CVE-2026-7273 is not sufficient.
  2. Remove management exposure. Disable HTTP/HTTPS management from untrusted networks, restrict it to a dedicated management VLAN or jump host, and never expose it to the internet.
  3. Assume prior compromise on exposed units. Rotate administrator, SNMP and any shared credentials stored on the device, and review configs for unexpected users, ACL changes or mirrored ports.
  4. Hunt. Look for unexpected outbound connections from switch management IPs and unusual requests to the CGI endpoints in any upstream proxy or firewall logs.
  5. Because exploitation is confirmed, federal agencies should follow CISA’s KEV deadline for CVE-2026-7273 and apply the new firmware as well.

Why it matters

“Patched” and “protected” diverged here for roughly six weeks: defenders who followed the KEV guidance and updated were still exploitable. This is a recurring pattern with network appliances, where a narrow fix addresses one reported trigger but leaves the underlying memory-safety weakness in the same parser.

References