Researchers from Binarly have discovered that Zyxel GS1900 network switches remain vulnerable to a critical exploit despite a previous attempt to fix the issue. The vulnerability allows attackers to execute commands without authentication if they can access the switch's web management interface. Zyxel has now released a new firmware update, Patch 3, for ten GS1900 models to address this issue. The flaw, initially tracked as CVE-2026-7273, was partially addressed with the earlier Patch 2, but the exploit persisted due to an oversight in handling web request parameters.
The new flaw, identified as CVE-2026-107441, was reported to Zyxel on September 29 after attackers had already developed a working exploit. GreyNoise reported that the attack targeted nearly a thousand switches, extracting sensitive data like configurations and network information. Many of these switches were still using default credentials. Zyxel's latest advisory provides new firmware for affected models, but there is no guidance for those unable to update immediately. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) had previously urged federal agencies to apply Patch 2 by September 24.
The exploit involves an out-of-bounds write flaw in the program handling web requests, where an oversized parameter overwrites the memory, allowing attackers to execute commands with root privileges. The Patch 2 update added a check for the parameter counter, but it was ineffective as it ran too late in the process. Patch 3 addresses this by checking the counter before copying parameters and limits the size of the copy. Researchers confirmed the fix but noted the exploit still works on Patch 2 without modifications. The attacker group, possibly linked to a Chinese-speaking group tracked as Red Heron, used the exploit to deploy a data-collection script on the compromised switches.
