Patched Zyxel GS1900 switches remained open to in-the-wild exploit (CVE-2026-107441)
Zyxel GS1900 series network switches that received a fix for a flaw that was later reported to have been exploited in the wild are still open to an exploit attackers used, Binarly found.
That’s because the patch fixed a different bug (CVE-2026-7273) from the one (CVE-2026-107441) the exploit actually relies on.
The exploit for an unpatched bug
In June 2026, Zyxel published an advisory on CVE-2026-7273, a stack-based buffer overflow vulnerability in the CGI program of Zyxel’s GS1900 firmware versions 2.90(XXXX.1)C0 and earlier, which could allow a LAN-based, unauthenticated attacker to potentially execute OS commands via a crafted HTTP request.
Fixed in firmware versions 2.90(XXXX.2)C0, the vulnerability was added to CISA’s Known Exploited Vulnerabilities catalog on September 21, after GreyNoise reported it being exploited by a Chinese-speaking threat actor to compromise and exfiltrate the configuration, networking information, and hashed root-level credentials from nearly 1,000 devices across 48 countries.
A few days before GreyNoise published the report, Binarly started to investigate malware previously analyzed by Acronis researchers and tied to the same attacker. Its investigation into the malware’s command and control server revealed an open directory hosting a file named gs1900_bundle.tar.gz.
The archive held a ready-to-use exploit: a Python 3.10 script, exp.py, obfuscated with PyArmor and shipped with its pytransform runtime library and compiled bytecode. It runs from the command line and targets /cgi-bin/dispatcher.cgi, the web management CGI on GS1900 switches.
When Binarly tested the exploit, it found something unexpected: the researchers confirmed that it still achieved unauthenticated command execution on all ten firmware releases that already carried Zyxel’s June fix. It therefore seems that attackers weren’t relying only on CVE-2026-7273 to compromise the switches (and possibly not at all).
Binarly notified Zyxel of its discovery on September 29, and on October 22 Zyxel pushed out a fix for CVE-2026-107441, an out-of-bounds write vulnerability in the CGI program of the Zyxel GS1900 series switch firmware that could allow a LAN-based, unauthenticated attacker to potentially execute OS commands via a crafted HTTP request.
“LLMs give great power to attackers (we believe the exploit is LLM-generated), but also to defenders (we used LLMs to set up emulated environments running the impacted firmware versions),” Binarly researchers said, and noted that cases such as this highlight the urgency for a more reliable way of checking vulnerabilities in software.
“Advisories and version numbers certainly help, but they cannot be blindly trusted. We truly believe the definitive way to assess whether software components contain vulnerabilities is by looking at its binary code,” they added.
What GS1900 owners should do
Any GS1900 switch running a 2.90 Patch 2 build (XXXX.2)C0 or earlier is vulnerable.
The fix for CVE-2026-107441 is in the 2.90 Patch 3 firmware releases. Administrators should upgrade every affected switch and consider searching for evidence of compromise.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
