Zyxel's June Patch Did Not Stop the Exploit That Took Data From 996 GS1900 Switches
Security / news
Zyxel's June Patch Did Not Stop the Exploit That Took Data From 996 GS1900 Switches
Binarly says the exploit works unchanged against all 10 Patch 2 builds, and Zyxel's new fix carries a different CVE that CISA's catalog does not list.
An unauthenticated attacker with network reachability to the web management service of a Zyxel GS1900 switch can run commands as root, even after the June patch, according to the security firm Binarly. Zyxel's fix is 2.90 Patch 3 for each of the 10 affected models, which it tracks as CVE-2026-107441.
The Hacker News reported the finding on Nov. 5. BleepingComputer, which put the story on Nov. 4, says Zyxel published its security advisory for the new flaw on Nov. 3.
How a patched switch stayed open
Zyxel's June 16 advisory covered CVE-2026-7273, a stack-based buffer overflow in the switch's CGI program, and shipped firmware ending in .2 for each of the 10 models. That advisory lists no workaround and does not mention CVE-2026-107441.
According to The Hacker News, Binarly's analysis found that the web request handler keeps up to 140 request parameters in a fixed area and never checked parameter size. The exploit sends an oversized 140th parameter that overwrites the counter, so the next parameter lands outside the area and replaces a function the program later calls. Patch 2 added a counter check that runs after the copy, so the exploit works against it unchanged. Patch 3 checks the counter first and limits the copy size.
Zyxel treats the missing size check as a separate flaw, per Binarly, which is why a second CVE exists.
| Model | Patch 2 build (June) | Patch 3 build |
|---|---|---|
| GS1900-8 | 2.90(AAHH.2)C0 | 2.90(AAHH.3)C0 |
| GS1900-24 | 2.90(AAHL.2)C0 | 2.90(AAHL.3)C0 |
| GS1900-24HPv2 | 2.90(ABTP.2)C0 | 2.90(ABTP.3)C0 |
| GS1900-48HPv2 | 2.90(ABTQ.2)C0 | 2.90(ABTQ.3)C0 |
The other six models follow the same pattern in the advisories, with the build suffix moving from .2 to .3.
Timeline, with a disagreement on one date
GreyNoise reported on Sept. 21 that attackers took data from 996 GS1900 switches in 48 countries, with activity around Aug. 17, and tied it to CVE-2026-7273. CISA added that CVE to its Known Exploited Vulnerabilities catalog the same day. Per BleepingComputer, Binarly confirmed on Sept. 28 that the exploit still worked on all 10 firmware releases patched in June, reported it to Zyxel on Sept. 29, and Zyxel assigned CVE-2026-107441 on Oct. 11.
The outlets differ on when the fix shipped. BleepingComputer says Oct. 22. The Hacker News says Oct. 23.
The Hacker News adds that Binarly found the exploit on Sept. 17, in an open folder on a server that also served as a command server for the JITTERLY backdoor, four days before GreyNoise went public.
The score and the unknowns
Binarly rates the flaw 9.8 on the CVSS severity scale, and the vendor's CVE entry gives 8.8. The gap is about reach: the vendor describes a "LAN-based, unauthenticated attacker", while Binarly says an attacker "only needs network reachability to the management service." For a switch whose management page is exposed to the internet, the higher figure is closer to the risk, and a default password makes it worse: GreyNoise found that 564 of the 996 compromised switches still used factory-default credentials.
What the sources do not establish matters as much. Neither GreyNoise nor Binarly says the 996 switches ran Patch 2, and the vendor's advisory does not say whether CVE-2026-107441 has been exploited. Binarly offers two explanations: Patch 2 was a faulty fix, or the attacks used a different flaw than the one CISA listed. BleepingComputer says it is unclear whether the exploit was built to bypass the earlier patches or hit a related flaw they missed.
The stolen data was switch configurations, hashed root credentials and network information. GreyNoise tied the activity to a group it says is the same as or related to Red Heron, which Acronis describes as Chinese-speaking, according to The Hacker News. BleepingComputer reports GreyNoise tracks the actor as Kapibala.
What owners should do
Install the Patch 3 build for the model, and change any factory-default credentials. Zyxel's advisory lists no workaround for switches that cannot be updated yet, and it does not say whether updating removes access an attacker already holds. A switch that sat on Patch 2 or earlier with a reachable management page should be treated as one whose configuration and root hash may have been read.
Binarly plans to publish a smaller proof-of-concept exploit, per The Hacker News, which gave no date. For earlier coverage of patches that left gaps, see PHP2Shell's skipped branches and Chrome 156's four critical fixes.
Sources
More in Security
- 01Apple's CVE-2024-27834, Patched in May 2024, Reaches CISA's KEV on Sekoia's Report of an APT29-Linked Web CampaignA 5.5-rated pointer authentication bypass is the second stage of an iOS 16.7 cookie-stealing chain. Sekoia's report also names a Plerdy SEO Tracker compromise and an Android chain.
- 02Plex2Shell Reached CISA's KEV 78 Days After Plex Shipped the FixFour Plex Media Server flaws chain into unauthenticated code execution on any server older than 1.43.3.10861, and attackers were installing miners within a day of a public proof of concept.
- 03CISA's BOD 26-04 Deadlines: 120 of 152 KEV Entries Since June Carry a Three-Day DeadlineThe directive that replaced BOD 22-01 on June 10 sets deadlines by exposure and exploit risk, and the catalog shows the short window is now the norm.
- 04VMware ESX Flaw Rated 2.7 Was a Zero-Day for Warp PandaCVE-2026-41709 lets an administrator skip the audit log, CrowdStrike says a China-nexus group used it in early 2026, and ESXi 7.0 has no listed fix.