Zyxel GS1900 CVE-2026-107441: Switches Patched in June Still Open to Unauthenticated Command Execution

Zyxel GS1900 switches that took the vendor's June security fix can still be taken over remotely. Zyxel's new advisory covers CVE-2026-107441, an out-of-bounds write in the switches' CGI program that lets an attacker run operating-system commands with a crafted HTTP request. Binarly, which reported it, tested an exploit recovered from real attacks and found it still achieved unauthenticated command execution on all ten firmware releases carrying the June patch.

What the June patch missed

In June Zyxel fixed CVE-2026-7273, a stack-based buffer overflow in the same CGI program. Binarly says that change added a check, but the check ran only after the unsafe copy had already occurred. The recovered tool is a PyArmor-obfuscated Python script that targets /cgi-bin/dispatcher.cgi, the switch's web management interface.

The two sides don't agree on severity. Zyxel describes a LAN-based, unauthenticated attacker; Binarly scores the flaw 9.8 against Zyxel's 8.8, needing only network access to the management service. Binarly also says either the June patch was wrong or the attacks used a different flaw.

The August attacks

GreyNoise reported in September that one attacker exploited 996 Zyxel switches across 48 countries on or about 17 August, taking configurations and hashed credentials, and that 564 of the victims had factory default credentials. Its country table lists 28 compromised switches in Thailand and one each in Malaysia and Vietnam. CISA tied those attacks to CVE-2026-7273 and added it to its Known Exploited Vulnerabilities catalogue on 21 September. Binarly notified Zyxel on 29 September, and Zyxel pushed out a fix on 22 October, twelve days before the advisory.

Fixed firmware by model

Zyxel lists these patched versions; anything at Patch 2 or earlier, including the June release, is vulnerable:

• GS1900-8: 2.90(AAHH.3)C0
• GS1900-8HP: 2.90(AAHI.3)C0
• GS1900-10HP: 2.90(AAZI.3)C0
• GS1900-16: 2.90(AAHJ.3)C0
• GS1900-24: 2.90(AAHL.3)C0
• GS1900-24E: 2.90(AAHK.3)C0
• GS1900-24EP: 2.90(ABTO.3)C0
• GS1900-24HPv2: 2.90(ABTP.3)C0
• GS1900-48: 2.90(AAHN.3)C0
• GS1900-48HPv2: 2.90(ABTQ.3)C0

Zyxel's fixes cover models still within their vulnerability support period. Help Net Security's advice is to upgrade every affected switch and consider searching for evidence of compromise.