Zyxel GS1900 Patch 2 Fails to Stop Root Exploit

The firmware CISA told federal agencies to install on Zyxel GS1900 switches does not stop the exploit attackers used. Binarly found that the in-the-wild exploit tied to CVE-2026-7273 runs unchanged against the 2.90 Patch 2 firmware and gives an unauthenticated attacker root command execution through the web management interface. Zyxel has now shipped 2.90 Patch 3 for 10 GS1900 models to close a separately tracked flaw, CVE-2026-107441.

This matters because many teams marked the issue closed after Patch 2. CISA added CVE-2026-7273 to its Known Exploited Vulnerabilities catalog on September 21 and set a September 24 deadline for the Patch 2 fix. A switch that met that deadline can still be exploited by the same attack.

Timeline

• June 16: Zyxel advisory names 2.90 Patch 2 as the fix for CVE-2026-7273.
• Around August 17: attackers take data from 996 GS1900 switches, according to GreyNoise.
• September 17: Binarly finds the exploit in an open folder on a server that also served as command infrastructure for the JITTERLY backdoor.
• September 21: GreyNoise publishes its attack report; CISA adds CVE-2026-7273 to KEV the same day.
• September 24: CISA deadline for federal agencies to apply Patch 2.
• September 29: Binarly reports the bypass to Zyxel.
• October 23: Zyxel posts 2.90 Patch 3 firmware.
• This week: Zyxel publishes the advisory for CVE-2026-107441. As of the KEV data updated November 4, CISA does not list CVE-2026-107441.

Why Patch 2 Did Not Stop the Exploit

Binarly traced the bug to the program that handles web requests on the switch. It stores each request parameter in a fixed area sized for 140 parameters. It never checked the size of a parameter, and before Patch 2 it never checked how many parameters it had stored. The exploit sends an oversized 140th parameter that overruns the end of that area and overwrites the parameter counter. The next parameter is then written outside the area, which lets the attacker swap the function the program is about to call for one that runs the attacker's command as root.

Patch 2 added a check on the counter, but the check runs after the oversized parameter has already been copied. By that point the counter holds the attacker's value, so the check passes and the write goes through. Binarly confirmed the exploit works without changes against Patch 2 on emulated firmware and on real hardware, though it did not name the hardware model. The exploit's own list of supported targets includes the Patch 2 build for the GS1900-24.

According to Binarly, Zyxel said CVE-2026-7273 covered the missing counter check and that it treats the missing size check as a separate flaw, CVE-2026-107441. In Patch 3, the counter is checked before a parameter is copied and the copy is limited in size. Binarly says this fixes the flaw.

Affected Models and Fixed Firmware

Zyxel's advisory lists Patch 2 and all earlier firmware as affected. Binarly says the flaw is present in all 10 Patch 2 builds. Fixed builds, posted with their release notes:

• GS1900-8: 2.90(AAHH.3)C0
• GS1900-8HP: 2.90(AAHI.3)C0
• GS1900-10HP: 2.90(AAZI.3)C0
• GS1900-16: 2.90(AAHJ.3)C0
• GS1900-24: 2.90(AAHL.3)C0
• GS1900-24E: 2.90(AAHK.3)C0
• GS1900-24EP: 2.90(ABTO.3)C0
• GS1900-24HPv2: 2.90(ABTP.3)C0
• GS1900-48: 2.90(AAHN.3)C0
• GS1900-48HPv2: 2.90(ABTQ.3)C0

The advisory lists no workaround for switches that cannot be updated yet. It also does not say whether updating removes access an attacker may already have, or what owners should look for on a switch that may have been compromised.

What the Attackers Took

GreyNoise reports that the attackers used the exploit to download a data-collection script onto the switches and left the output to be picked up later. The data included switch configurations, hashed root credentials and network information. Of the 996 switches, 564 still used factory-default credentials, so the hashes taken from those devices offer little protection. The report does not say which firmware the switches ran or how the attackers reached them.

GreyNoise ties the activity to a group that is the same as, or related to, the one Acronis tracks as Red Heron and describes as Chinese-speaking. Acronis previously linked the JITTERLY backdoor to Red Heron in a campaign against Gitea servers. The exploit Binarly recovered sat on a server that also ran JITTERLY command infrastructure, and Binarly says it matches the exploit GreyNoise described.

Severity and Exposure Disagreement

Binarly rates CVE-2026-107441 at CVSS 9.8 and says an attacker needs only network reachability to the management service. Zyxel's CVE entry scores it 8.8 and describes a LAN-based, unauthenticated attacker. The gap affects how teams rank this fix. A management interface reachable from a flat internal network, a guest segment or a compromised workstation still falls within Zyxel's own description of the threat.

What Is Still Unknown

• Whether any of the 996 attacked switches were running Patch 2. Neither GreyNoise nor Binarly says so.
• Whether CVE-2026-107441 has been exploited on its own. Zyxel's advisory does not say.
• Whether Patch 2 was a faulty fix for CVE-2026-7273, or whether the attacks exploited a different flaw from the one CISA listed. Binarly gives both explanations.
• When CISA will add CVE-2026-107441 to KEV.

Analysis

This is a familiar edge-device pattern: a vendor fixes the symptom that was reported, the exploit still works, and the advisory that compliance programs track points to the wrong build. The data the attackers took, including configurations and root credential hashes from switches where more than half still had default passwords, gives a starting point for follow-on access that a firmware update alone may not remove. Any GS1900 fleet recorded as remediated for CVE-2026-7273 should be treated as still exposed until Patch 3 is confirmed on each device.