Zyxel GS1900 June patch missed flaw behind attacks on 996 switches
Original title: Zyxel Switch Patch Missed Flaw Behind Wave of Attacks
Binarly says all 10 June firmware releases still allow unauthenticated root commands; Zyxel shipped a later fix.
Binarly found that a June Zyxel GS1900 firmware update left an out-of-bounds write in the web management program that can let an unauthenticated attacker run OS commands as root. The issue, now CVE-2026-107441, survived in all 10 releases shipped as the June fix for CVE-2026-7273. GreyNoise had reported exploitation against 996 GS1900 switches in 48 countries, and CISA added CVE-2026-7273 to the KEV catalog on September 21. Zyxel confirmed the new flaw, released firmware on October 22 and published an advisory on November 3.
Unconfirmed: Binarly says either the June CVE description was wrong or the attacks used a different flaw; local-network access and the score are disputed.
- Zyxel fixed CVE-2026-7273 on June 16 and rated that issue 8.8.
- Binarly said the June check ran only after the unsafe copy.
- Zyxel rates CVE-2026-107441 at 8.8; Binarly rates it 9.8.
- On the GS1900-8, 2.90(AAHH.2)C0 and earlier is affected and 2.90(AAHH.3)C0 is fixed.
- June releases remain listed as affected, so those switches still need the new firmware.
Impact: Unauthenticated root OS command execution on switches
| Product | Affected | Fixed in |
|---|---|---|
| Zyxel GS1900 | ten models; June fix releases still affected | — |
| Zyxel GS1900-8 | 2.90(AAHH.2)C0 and earlier | 2.90(AAHH.3)C0 |
- 1.Install Zyxel's October 22 firmware updates, including 2.90(AAHH.3)C0 on the GS1900-8.
- 2.Treat switches last updated with the June releases as still vulnerable.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-107441 | Out-of-bounds write in Zyxel GS1900-24E CGI up to 2.90(AAHK.2)C0 | 8.8 | — | ||
| CVE-2026-7273 | Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability | 8.8 | 3% | KEVPoC | KEV |
From the original article
2 min read at infosecurity-magazine.com
Zyxel’s June GS1900 patch did not block the exploit used against 996 switches, Binarly found
By Alessandro Mascellino · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.