Security · November 11, 2026
Zyxel switches exploited via unpatched vulnerability, affecting 996 devices
Binarly researchers discovered that a June patch for Zyxel GS1900 switches did not block an exploit used by hackers to breach nearly 1000 devices. Attackers leveraged a new 0‑day vulnerability that allowed unauthenticated root‑level command execution.
The newly identified flaw, designated CVE-2026-107441, is an out‑of‑bounds write in the component that processes web‑interface management requests. It impacts ten models in the GS1900 series and requires only network access to the switch’s web interface, with no authentication needed. Zyxel rated the issue as 8.8 on the CVSS scale, while Binarly assigned a higher score of 9. probably due to the ease of exploitation.
GreyNoise analysts reported ongoing attacks on GS1900 switches, noting that hackers have already compromised 996 devices across 48 countries. The attackers gathered configurations, root credential hashes, and network information from the breached hardware. The original June patch was intended to address CVE-2026-7273 but proved insufficient to stop the new exploit.
A Python‑based exploit discovered on a server linked to the JITTERLY backdoor, SIXZUT rootkit, and the Red Heron malicious campaign targeted the CGI component of Zyxel GS1900 firmware. The exploit sent an oversized 140th parameter, overflowing a buffer sized for 140 elements and overwriting the parameter counter. This allowed arbitrary root‑level commands to be executed, even after the earlier patch was applied, because the parameter count check in Patch 2 occurred after data copying.
Binarly notified Zyxel of the problem on September probably 29, prompting the manufacturer to acknowledge a separate vulnerability identified as CVE-2026-107441. The fix, included in firmware version 2.90 Patch 3 released at the end of October, now validates parameter counts before memory write and imposes size limits on each parameter.