Partial Zyxel Patch: 996 GS1900 Switches Compromised by New CVE-2026-107441

Zyxel published an advisory on November 3, 2026 correcting a technical misattribution: attacks on GS1900 switches initially blamed on CVE-2026-7273 — patched in June — were actually caused by a new vulnerability, CVE-2026-107441, which bypassed the previous fix. Approximately 996 devices in 48 countries were already compromised, with data exfiltrated starting August 17, 2026. CISA had added CVE-2026-7273 to the KEV catalog on September 21 with a patch deadline of September 24, an order that turned out to be based on a misidentification.

The Bypass Mechanism: When the Check Arrives Too Late

The CGI program in Zyxel GS1900 firmware allocates a fixed area for 140 HTTP parameters. The original vulnerability, CVE-2026-7273, exploited the lack of a check on the number of parameters. The June patch — dubbed Patch 2 — added a counter check, but with an architectural flaw: the check executed after the parameter was copied into the allocated area.

As documented in Binarly's technical analysis reported by The Hacker News, an oversized 140th parameter overwrote the counter itself with an attacker-chosen value. The next parameter was then written outside the intended area, enabling a function pointer swap and arbitrary command execution. Binarly reported that "the attacker's commands run with root privileges"; Zyxel describes the same condition as "achieve OS command execution." The exploit worked unmodified across all 10 firmware versions with Patch 2.

"Patch 2 added a check on the counter, but the check runs only after the oversized parameter has been copied. By then the counter holds the attacker's value, so the check does not stop the write." — Binarly technical analysis, The Hacker News

The Timeline That Undoes the Misattribution

The discovery follows a precise trajectory. On September 17, 2026, Binarly researchers found the exploit in an open folder on a C2 server linked to the Red Heron group, also tracked with the JITTERLY malware. On September 28, Binarly confirmed the exploit's effectiveness on all 10 Patch 2 firmware versions. Notification to Zyxel occurred September 29; the vendor confirmed the new vulnerability on October 11, assigned CVE-2026-107441, and released the fixed firmware on October 22.

The official advisory is dated November 3, 2026. Concurrently, it emerges that CISA had added CVE-2026-7273 to the KEV catalog on September 21 with a patch deadline of September 24. CVE-2026-107441 is not listed in the KEV catalog as of the sources.

Analysis: The Limits of Declared-Version Verification

Binarly researchers, cited by SecurityWeek, leveled a critique at the dominant verification model: "Cases such as this highlight the urgency for a more reliable way of checking vulnerabilities in software. Advisories and version numbers certainly help, but they cannot be blindly trusted." The statement identifies a structural limit: organizations that had updated to firmware .2C0 considered themselves protected based on declarative information.

Binarly described binary code analysis as a "more reliable way" compared to version-only verification. The source does not specify whether inventory-based vulnerability management tools could have detected the bypass, nor does it claim binary verification would have revealed the ineffectiveness "immediately." These operational judgments are not present in the original sources.

The discrepancy between the official CVSS 8.8 (vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and Binarly's 9.8 assessment likely reflects a different attack vector evaluation: the official record indicates adjacent network access (AV:A), while Binarly may have assessed unspecified network access (AV:N). The sources do not explicitly resolve this discrepancy.

What to Do Now

• Immediately update all Zyxel GS1900 switches to firmware .3C0, regardless of whether they were already patched in June for CVE-2026-7273: the previous patch protected against the original vulnerability, but not against the new CVE-2026-107441.
• Check network logs to determine if firmware .2C0 was running between August 17 and October 22, 2026: this is the window during which exfiltration is documented.
• Rotate management credentials and review exposed configurations on the 564 devices identified with default passwords: stolen data included credential hashes.
\li>Assess management interface exposure: Zyxel describes the attack as "LAN-based," but researchers detected switches with interfaces reachable from outside the local network.

The Lesson: A Single Primary Source for Technical Analysis

The Zyxel case documents a significant methodological limit for the industry. The technical analysis of the bypass mechanism comes exclusively from Binarly; other sources — SecurityWeek, BleepingComputer, CSO Online — repeat the numerical data and timeline, but do not independently verify the exploit's workings. The text must therefore not imply convergence of independent sources on the technical analysis.

The organization that had met the CISA timeline for CVE-2026-7273 found itself compromised nonetheless, with a discovery delay that allowed months of exfiltration. The patch for the original CVE was partially effective, but not for the new vulnerability: this distinction is central to understanding the incident without overclaiming a complete patch process failure.

For vulnerability management, the incident indicates that textual advisories and version numbers have a structural limit. Binary code verification offers, according to Binarly, a "more reliable" approach — not a full replacement of the current system, but a complement that could have reduced the exposure window.

Sources

• securityweek.com
• thehackernews.com
• bleepingcomputer.com
• csoonline.com
• 2-spyware.com
• nvd.nist.gov
• cve.org