Zyxel GS1900 Patch Fails to Block Zero-Day Exploit Allowing Root Command Execution

Zyxel GS1900 network switches that received the vendor’s earlier fix for an actively exploited flaw are still open to the exploit attackers used, researchers at Binarly found.

The exploit lets anyone who can reach a switch’s web management interface run commands on it without logging in. Zyxel has released new firmware for 10 GS1900 models that closes the hole.

The earlier fix is the 2.90 Patch 2 firmware, named in a June 16 advisory for a flaw tracked as CVE-2026-7273. The new 2.90 Patch 3 firmware fixes a flaw now tracked separately as CVE-2026-107441, which the exploit relies on. It was posted on October 23, and the vendor announced it in an advisory earlier this week.

The researchers, who reported the flaw to the vendor on September 29, call it a zero-day. Attackers already had a working exploit for it by then.

GreyNoise, which monitors attack traffic through a network of sensors, reported on September 21 that attackers took data from 996 GS1900 switches around August 17. It tied the attacks to CVE-2026-7273, and the researchers say the exploit it described matches the one they found.

Neither GreyNoise nor Binarly says the attacked switches were running the earlier fix, and the vendor’s advisory does not say whether the new flaw has been exploited.

Which Switches Need the New Firmware

Zyxel’s security advisory lists the affected and fixed firmware for each model:

Switches on Patch 2 or any earlier firmware need the Patch 3 build for their model. The builds are posted with their firmware release notes.

The advisory lists no workaround for owners who cannot update yet. It also does not say whether updating removes access an attacker may already have, or what owners should check if a switch may have been compromised.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-7273 to its Known Exploited Vulnerabilities (KEV) catalog on September 21 and gave federal agencies until September 24 to apply the vendor’s fix, the Patch 2 firmware. The listing came the day the earlier attacks were made public.

The researchers’ vulnerability advisory says the new flaw is present in all 10 of those Patch 2 builds. It also says “an attacker only needs network reachability to the management service”, while the vendor’s advisory describes a “LAN-based, unauthenticated attacker”.

The researchers rate the flaw 9.8 out of 10 on the CVSS severity scale, against 8.8 in the vendor’s CVE entry, and say the attacker’s commands run with root privileges.

Why the Earlier Fix Did Not Stop the Exploit

Binarly’s technical analysis traces the flaw to the program that handles web requests on the switch. It is an out-of-bounds write, meaning the program writes data beyond the memory allocated for it.

The program stores each request parameter in a fixed area that can accommodate 140 parameters. It never checked the size of a parameter, and before Patch 2 it never checked how many parameters it had stored.

The exploit sends a 140th parameter that is too large, causing it to overrun the end of that area and overwrite the program’s parameter counter. The next parameter is then written outside the area, allowing the attacker to swap the function the program is about to call for one that runs the attacker’s command.

Patch 2 added a check on the counter, but the check runs only after the oversized parameter has been copied. By then the counter holds the attacker’s value, so the check does not stop the write. The researchers say the exploit works against Patch 2 without changes.

They tested it on emulated firmware and on real hardware, though they do not say which model. The exploit’s own list of supported firmware includes the Patch 2 build for the GS1900-24.

According to the researchers, Zyxel told them that CVE-2026-7273 was about the missing counter check, and that it treats the missing size check as a separate flaw, now CVE-2026-107441.

In the Patch 3 code, the counter is checked before a parameter is copied, and the copy is limited in size. The researchers say this fixes the flaw.

What Is Known About the Attacks

GreyNoise’s attack report says the attackers used the exploit to download a data-collection script onto the switches and left the collected data to be picked up. The data included switch configurations, hashed root credentials, and network information. Of the 996 switches, 564 still used factory-default credentials.

The report does not say which firmware the switches were running or how the attackers reached them. It says the attackers are the same as, or related to, a group that Acronis tracks as Red Heron and describes as Chinese-speaking. Acronis linked a backdoor called JITTERLY to Red Heron in an earlier campaign that targeted Gitea servers.

The researchers found the exploit on September 17 in an open folder on a server that also acted as a command server for JITTERLY.

Their advisory offers two explanations. Either the Patch 2 update was a faulty fix for CVE-2026-7273, or the attacks exploited a different flaw from the one CISA listed.

The researchers say they will soon publish a smaller version of the exploit as a proof of concept. CISA’s KEV catalog data, last updated yesterday, does not list CVE-2026-107441.