Zyxel June GS1900 Patch missed actively exploited second flaw

This is a new development in a story we reported earlier: Zyxel patches GS1900 zero-day exploited to compromise 996 switches.

Zyxel published an advisory on November 3, 2026 disclosing a fix for CVE-2026-107441, but GS1900 switches running the June CVE-2026-7273 patch remain exposed to active in-the-wild exploitation, and the fix is only in Patch 3 releases.

On June 16, 2026, Zyxel released security updates for CVE-2026-7273. The flaw is a stack-based buffer overflow in the GS1900 CGI program, and Zyxel fixed it in firmware 2.90(XXXX.2)C0. The June advisory covered versions 2.90(XXXX.1)C0 and earlier before the fix appeared, and the vendor rated CVE-2026-7273 at 8.8.

Zyxel confirmed the new vulnerability on October 11, 2026 and assigned it CVE-2026-107441. Binarly reported its findings to Zyxel on September 29, 2026. The flaw is an out-of-bounds write in the GS1900 web management CGI program that lets an unauthenticated attacker run OS commands through crafted HTTP requests.

Zyxel rates CVE-2026-107441 at 8.8 as LAN-based, while Binarly rates it 9.8, says it needs only management-service reachability, and notes commands run as root. CISA’s Known Exploited Vulnerabilities catalog does not list CVE-2026-107441.

Around August 17, 2026, GreyNoise observed a suspected Chinese-speaking threat actor it tracks as Kapibala compromising 996 Zyxel GS1900 switches in 48 countries. Help Net Security listed Italy, the United States, Taiwan and South Korea among the most affected places. It reported the compromise on September 21, 2026 and attributed the exploitation to CVE-2026-7273.

Binarly found the exploit on September 17, 2026 in an open folder on a server that also acted as a JITTERLY command server. An open directory on the attacker’s command and control server hosted gs1900_bundle.tar.gz. Before GreyNoise’s September 21 report, Binarly investigated malware analyzed by Acronis and tied to the same attacker.

The attackers executed commands remotely, then made each switch download a script that collected device configurations, hashed root credentials, and network information. The attacks involved the SIXZUT rootkit alongside the JITTERLY backdoor. GreyNoise found 564 of the 996 compromised switches still used factory-default credentials, and GreyNoise says the collector script arrived over TFTP on port 6969.

GreyNoise linked the activity to the Red Heron campaign tied to Gitea exploitation, and Acronis linked the JITTERLY backdoor to Red Heron. GreyNoise’s report says attackers left the collected data for later pickup. The same report does not say which firmware the switches ran or how attackers reached them.

Zyxel called CVE-2026-107441 a separate flaw rather than a CVE-2026-7273 bypass, saying the exploit also abused missing length checks on HTTP parameters. Patch 2’s counter check runs only after the program copies an oversize parameter, so it does not stop the write. Before Patch 2, the program never checked parameter count or parameter size. In Patch 3, the program checks the counter before it copies a parameter and limits the copy size.

BleepingComputer reports attackers bypassed Patch 2 by corrupting a parameter counter before validating it.

The flaw affects ten GS1900 models, including GS1900-8, GS1900-24, and GS1900-48. Any GS1900 switch running a 2.90 Patch 2 build (XXXX.2)C0 or earlier is vulnerable, and the CVE-2026-107441 fix is in 2.90 Patch 3 releases. For the GS1900-8, affected firmware is 2.90(AAHH.2)C0 or earlier, while version 2.90(AAHH.3)C0 carries the fix. The Hacker News states the Patch 3 firmware was posted on October 23, 2026, while other sources date the release to October 22, 2026.

Binarly tested on emulated firmware and real hardware without naming a model, and the exploit list includes the Patch 2 build for GS1900-24. Its researchers call CVE-2026-107441 a zero-day, and attackers already had a working exploit by September 29. The researchers published their work on November 3, 2026. The new flaw is present in all 10 Patch 2 builds.

Binarly confirmed on September 28, 2026 that the exploit still gave unauthenticated command execution on every firmware version that included the June patch. The researchers concluded attackers were not relying only on CVE-2026-7273 and possibly not at all to compromise the switches. The exploit specifically checked for firmware versions patched for CVE-2026-7273.

Researchers believe the exploit is LLM-generated, meaning created by a large language model, and they used LLMs to set up emulated environments running the affected firmware. Binarly researchers said “(we believe the exploit is LLM-generated).” They also said advisories and version numbers cannot be blindly trusted and that assessing vulnerabilities requires examining binary code.

Zyxel told researchers CVE-2026-7273 was about the missing counter check, treating the missing size check as CVE-2026-107441. Researchers offer two explanations: a faulty June fix for CVE-2026-7273, or attacks through a different flaw than the one CISA listed.

CISA added CVE-2026-7273 to its Known Exploited Vulnerabilities catalog on September 21, 2026, and federal agencies had to apply the Patch 2 fix by September 24, 2026. That deadline applied to CVE-2026-7273 only, not to CVE-2026-107441. Canada’s Cyber Centre has warned the vulnerability is being exploited, and the scale of attacks currently underway is unknown.

Patches are available only for GS1900 models still within their support period. Zyxel’s advisory lists the June releases among affected versions, so switches last updated in June still need the new firmware. Neither GreyNoise nor Binarly says the compromised switches ran the June fix, and the vendor’s advisory does not say whether attackers exploited CVE-2026-107441.

Zyxel’s advisory lists no workaround for owners who cannot update and does not say whether updating removes access an attacker may already have. KinoSec says a version check would have marked the affected GS1900 switches as patched.

Administrators should upgrade every affected switch and consider searching for evidence of compromise, exporting logs first because a reboot erases the buffered log. They should save running and startup configurations, flash log and buffer log before rebooting. Zyxel’s ZON utility lists model and firmware on a switch’s broadcast domain, and the default admin login is admin/1234.

Administrators upload the .bix firmware to Active and Backup images, then reboot, but uploading the wrong model’s firmware file may damage the switch. After a hit, use Factory Default, rebuild settings by hand, and open a Zyxel support case quoting both CVEs. Change secrets under Configuration > AAA and SNMP community strings.

Add a Permit profile for the admin subnet under Remote Access Control and enable it. Block ports 80 and 443 to the switch from all networks except the admin subnet as a temporary measure.

Home users with basic unmanaged switches are not affected because the flaw lives in the GS1900 web management feature. Zyxel’s advisory lists ten GS1900 models and says products not listed are unaffected; other Zyxel switches still need their own patch checks.

Researchers have not said how many of the 996 compromised switches were later cleaned. GreyNoise attributes the earliest activity by this actor to May 7, 2026, and its published hashes are not tied to the switch script. Researchers say they will soon publish a smaller proof of concept. 2-Spyware expects pressure for Zyxel to update advisories and for CISA to list CVE-2026-107441 if confirmed.