Zyxel GS1900 switches patched in June were still hackable: install the new firmware for CVE-2026-107441

Zyxel has released new firmware for ten GS1900 smart-managed switch models to fix CVE-2026-107441, an unauthenticated remote code execution flaw. Attackers were exploiting it before a fix existed. Zyxel published its advisory on November 3. Security firm Binarly found that the exploit behind a summer campaign against these switches still worked on firmware Zyxel had already patched in June.

Why it matters: many admins patched GS1900 switches for CVE-2026-7273 after CISA added that bug to its Known Exploited Vulnerabilities catalog on September 21, and assumed they were safe. They were not. If you have one of these switches, the June update is not enough. You need the new firmware.

What happened

According to BleepingComputer's timeline:

• June 16: Zyxel patched CVE-2026-7273, a pre-authentication buffer overflow in the GS1900 web interface.
• From around August 17: GreyNoise saw a suspected Chinese-speaking actor it tracks as Kapibala compromising switches. GreyNoise counted 996 compromised devices in 48 countries. The attackers pulled device configurations, hashed root credentials and network details.
• September 21: GreyNoise blamed the campaign on CVE-2026-7273, and CISA added that CVE to KEV.
• September 28–29: Binarly confirmed the exploit still worked against all ten patched firmware releases and reported it to Zyxel.
• October 22: Zyxel shipped fixed firmware.
• November 3: Zyxel and Binarly published advisories.

Binarly found the exploit while investigating infrastructure tied to the JITTERLY backdoor. BleepingComputer says an exposed archive held an obfuscated Python exploit, and the exploit checked for the firmware versions patched for CVE-2026-7273. Daily CyberSecurity reports that Binarly believes the exploit was LLM-generated.

The bug

Binarly's advisory says the flaw is an out-of-bounds write in dispatcher.cgi, the web interface's CGI handler. It lets an unauthenticated attacker run OS commands as root. According to BleepingComputer, the June patch added buffer overflow checks, but an attacker could get around them by corrupting a parameter counter before the check ran. Zyxel treats the new issue as a separate flaw because the exploit also relied on missing length checks for HTTP parameters.

The new firmware caps each copied field at 511 bytes and checks the parameter count before copying, according to Daily CyberSecurity's summary of Binarly's analysis. Zyxel's advisory says a LAN-based attacker could trigger the bug with a crafted HTTP request.

Affected models and fixed firmware

From Zyxel's advisory. The listed version and every earlier version are vulnerable. Note that the ".2" builds were the June fixes for CVE-2026-7273.

Zyxel says it patches only models still inside their vulnerability support period, and that products not listed are not affected.

What to do

1. Check the firmware version on every GS1900 switch. If the version ends in .2)C0 or lower, it is vulnerable. That includes switches you updated in June.
2. Install the .3)C0 firmware for your model from Zyxel.
3. Take the web interface off untrusted networks. Restrict it to a management VLAN. The attack goes through the web interface, so access to that interface is the exposure.
4. Change default and shared passwords. Daily CyberSecurity, citing GreyNoise, says 564 of the victims were still using factory default credentials. The attackers also took hashed root credentials, so rotate any password that was set on a switch exposed before you patched.
5. Treat exposed switches as possibly compromised. If a GS1900's web interface was reachable from an untrusted network between August and your update, review its configuration, and consider resetting it to factory settings and rebuilding it from a known-good config.

What to watch

Binarly says it plans to publish a minimized proof of concept, according to Daily CyberSecurity. Once working exploit code is public, attacks usually spread beyond a single actor. Also watch whether CISA adds CVE-2026-107441 to KEV. Zyxel's own advisory does not give a CVSS score. Binarly's advisory lists 9.8, while Daily CyberSecurity reports 8.8.