74 openlast updated

HomeOctober 2026 patch cycleCVE-2026-107441 Zyxel GS1900: exploited, old patch missed it

Patch nowEnterpriseHomelabfrom 2026-10

CVE-2026-107441 Zyxel GS1900: exploited, old patch missed it

Part of October 2026 patch cycle

Vendor
Zyxel
Products
Zyxel GS1900-8, GS1900-8HP, GS1900-10HP, GS1900-16, GS1900-24, GS1900-24E, GS1900-24EP, GS1900-24HPv2, GS1900-48, and GS1900-48HPv2
Published
Status
Open

Call: Patch now. If you patched your GS1900 switches for CVE-2026-7273 back in June and called it done, it wasn’t. Binarly found the exploit attackers have been using against these switches, and it works unchanged on the firmware that was supposed to fix 7273. The bug it actually hits is a separate one, now CVE-2026-107441. Zyxel shipped the real fix on Oct 22 and published the advisory on Nov 3. Install the 2.90(…3)C0 firmware for your model.

What breaks: dispatcher.cgi, the program behind the switch’s web interface, copies every POST parameter into a fixed buffer without checking how big each one is or how many there are. A crafted request corrupts memory and gets an unauthenticated attacker OS commands on the switch. Zyxel says the attacker has to be “LAN-based.” In practice that means anyone who can reach the management web UI.

Why the June patch didn’t help: CISA added CVE-2026-7273 to KEV on Sep 21, after GreyNoise reported attacks that stole configurations and hashed root credentials from 996 GS1900 switches in 48 countries. Binarly then found the attacker’s tool, an obfuscated “Zyxel GS1900 Pre-Auth RCE” script, on infrastructure tied to the JITTERLY Linux backdoor. Its config even lists addresses for the patched GS1900-24 firmware. Binarly says either the 7273 patch didn’t cover the flaw being exploited, or the attacks were pinned on the wrong CVE. Either way, switches carrying only the 7273 fix stayed exposed until Oct 22. Zyxel’s own advisory doesn’t mention exploitation. That link comes from Binarly.

Who’s hit: GS1900-8, -8HP, -10HP, -16, -24, -24E, -24EP, -24HPv2, -48 and -48HPv2 on 2.90(…2)C0 or earlier. The fixed build is the matching 2.90(…3)C0, for example GS1900-24 2.90(AAHL.3)C0 and GS1900-48HPv2 2.90(ABTQ.3)C0. Zyxel only patched models still inside its vulnerability support period.

What to do:

  • Install 2.90(…3)C0 on every GS1900. Don’t skip one because it already has the 7273 update.
  • Get the web UI off user and guest networks. Keep switch management on its own VLAN.
  • Change default credentials. GreyNoise found 564 of the victims still on them.
  • If the web UI was reachable from untrusted networks, treat the switch as possibly compromised. Check for unexpected telnetd listeners or processes, and rotate anything stored in the config.

Sources: Zyxel advisory, SecurityOnline, ctxsec.

Sources

More from October 2026 patch cycle