Attackers compromised Zyxel GS1900 switches that already carried the vendor’s June security fix, because their exploit targeted a separate, previously unknown flaw, according to research from security firm Binarly. Organizations that closed out the earlier vulnerability on their tracking sheets may still have exposed switches running firmware 2.90 Patch 2 or older.
Zyxel published an advisory on November 3 for CVE-2026-107441, an out-of-bounds write in the CGI program that serves the switch’s web management interface. The advisory says an unauthenticated attacker on the local network could send a crafted HTTP request and potentially execute operating system commands. It lists ten GS1900 models, from the GS1900-8 to the GS1900-48HPv2, and names the fixed builds as the .3 releases, known as 2.90 Patch 3. The advisory does not say whether the flaw has been exploited.
The earlier bug, CVE-2026-7273, is a stack-based buffer overflow in the same CGI program. Zyxel fixed it in June with Patch 2, and CISA added it to its Known Exploited Vulnerabilities catalog on September 21. GreyNoise reported exploitation against nearly 1,000 devices in 48 countries and attributed the activity to a Chinese-speaking threat actor. The attackers reportedly took configuration data, networking information and hashed root-level credentials.
Binarly found that the tools behind those attacks did not depend on CVE-2026-7273. Its researchers recovered an exploit archive from an open directory on a malware command-and-control server. It contained a Python script, obfuscated with PyArmor, that achieved unauthenticated command execution on all ten firmware releases that included the June fix. Binarly says the attackers deployed variants of the Jitterly and Sixzut malware, which Acronis had analyzed previously, and that they exploited the new flaw as a zero-day. Binarly believes a large language model generated the exploit script, though it offered that as an assessment rather than a confirmed fact.
The decision sits with network engineering teams that own branch and campus switching and with the vulnerability management group that tracks closure by CVE number. A ticket closed against CVE-2026-7273 says little about whether a given switch is safe. Binarly’s point, as relayed by ThaiCERT, is that teams should not rely only on version numbers or earlier patches when assessing exposure. Inventory every GS1900 unit, compare its build against the Patch 3 list and review network activity for abnormal behavior.
Patching does not remove an intruder who got in first. Teams should check for signs of compromise after the upgrade, and because the stolen data reportedly included hashed root credentials, they will need to decide whether to rotate them. Zyxel’s advisory lists no workaround, and it says patches exist only for models still within their vulnerability support period. Owners of GS1900 units outside that window have no vendor fix to apply.