Zyxel has released emergency firmware updates to fix a zero-day vulnerability in 10 of its GS1900 series smart managed switches after security researchers discovered that a June 2026 patch failed to block an exploit used to compromise nearly 1,000 devices.
Tracked as CVE-2026-107441, the flaw is an unauthenticated out-of-bounds write vulnerability in the switch web management interface that allows attackers with network access to execute operating system commands as root via crafted HTTP requests. Security firm Binarly discovered the defect while analyzing an active exploitation campaign reported by GreyNoise on September 21, 2026. Those attacks were initially attributed to CVE-2026-7273, a flaw Zyxel had addressed on June 16 with firmware version 2.90 Patch 2. When Binarly tested the attack payload against the Patch 2 firmware, the exploit still succeeded across all 10 switch models.
According to Binarly and Cyber Security News, the vulnerability resides in the dispatcher.cgi binary, with identical parsing code present in httprestorecfg.cgi and httpupload.cgi. The web management program stores incoming HTTP request parameters in a fixed-size global memory block containing 140 slots of 1,024 bytes each, followed immediately in memory by a parameter counter. Because the code copies incoming parameter data before checking the counter or validating parameter length, an oversized value in slot 139 spills over and overwrites the counter itself. By setting the counter to a negative value, an attacker can write to memory preceding the buffer, overwrite function pointers, and gain root command execution.
Zyxel's June update added a counter check, but placed it after the memory copy operation had already occurred. Binarly also noted that Zyxel misclassified the original defect as a stack-based buffer overflow rather than a global memory corruption flaw, and scored CVE-2026-107441 at 9.8 on the CVSS scale compared to Zyxel's 8.8 rating.
GreyNoise observed a threat actor exploiting the flaw around August 17, 2026, compromising 996 Zyxel GS1900 switches across 48 countries, primarily in Italy, the United States, and Taiwan. Of the hijacked devices, 564 still used factory default login credentials. The attacker deployed a Python script obfuscated with PyArmor to pull a secondary collection script via TFTP, harvesting device configurations, network settings, and hashed root passwords into a web-accessible directory.
Binarly reported the incomplete patch to Zyxel on September 29. Zyxel published firmware version 2.90 Patch 3 on October 22 and issued its public security advisory on November 3. The updated firmware validates the counter prior to copying data and enforces strict size limits on parameters across affected models, including the GS1900-8, GS1900-8HP, GS1900-10HP, GS1900-24E, GS1900-48, and GS1900-48HPv2.
Because the advisory lists no workarounds and attackers previously exfiltrated hashed root credentials, administrators running GS1900 switches must install the 2.90 Patch 3 firmware, restrict web management interfaces to isolated admin networks, and rotate all device passwords immediately.
