Patched Zyxel GS1900 switches remained open to in-the-wild exploit (CVE-2026-107441)

Security firm Binarly discovered that an in-the-wild exploit targeting Zyxel GS1900 switches kept working even after Zyxel's June 2026 patch, because that fix addressed CVE-2026-7273 while the actual exploit leverages a separate, previously unknown bug, CVE-2026-107441. CVE-2026-7273, a stack-based buffer overflow in the GS1900 CGI program, was added to CISA's KEV list in September after GreyNoise found a Chinese-speaking threat actor using it to steal configs and hashed root credentials from nearly 1,000 devices in 48 countries. While investigating related malware infrastructure, Binarly found a ready-made exploit script that still achieved unauthenticated command execution on all ten firmware builds already carrying the June patch, pointing to an out-of-bounds write flaw in the CGI dispatcher instead. Zyxel released a fix for CVE-2026-107441 on October 22 in the 2.90 Patch 3 firmware, and administrators running Patch 2 or earlier should upgrade immediately and check for signs of prior compromise.