Vulnerability & Exploit · thehackernews.com

Zyxel GS1900 Patch 2 Fails to Stop Unauthenticated Root-Command Exploit

Nov 5, 2026 · Original article ↗

Summary

Binarly says Zyxel GS1900 Patch 2 remains vulnerable to a network-reachable, unauthenticated command-execution flaw (CVE-2026-107441); Patch 3 fixes it. GreyNoise reported data collection from 996 switches, but their firmware status is unknown.

Key points

Binarly says CVE-2026-107441 affects all 10 listed GS1900 Patch 2 builds and allows an unauthenticated attacker with management-interface network access to run commands as root.
The exploit uses an oversized request parameter to overwrite a counter; Patch 2 checks the counter only after copying the parameter, so the researchers say the exploit still works without changes.
Zyxel's Patch 3 firmware limits the copy and checks the counter before copying. Owners on Patch 2 or earlier need the Patch 3 build for their model.
GreyNoise reported that attackers collected configurations, hashed root credentials, and network information from 996 GS1900 switches around August 17; 564 reportedly retained factory-default credentials.
Neither GreyNoise nor Binarly established whether the affected switches were running Patch 2, and Zyxel's advisory does not say whether CVE-2026-107441 has been exploited.
CISA's KEV listing covers CVE-2026-7273, not the newer CVE-2026-107441.

Article Details

Vulnerability Types: Out-of-bounds write
Severity: Researchers rated CVE-2026-107441 9.8/10; the vendor's CVE entry rates it 8.8.
Affected Versions: Zyxel GS1900 firmware 2.90 Patch 2 and earlier
Exploitation Status: reported
Exploit Availability: unknown
Patch Status: available

MITRE ATT&CK

T1005 · Data from Local SystemThe attackers collected switch configurations, hashed root credentials, and network information from the switches.T1105 · Ingress Tool TransferGreyNoise reported that attackers used the exploit to download a data-collection script onto the switches.T1210 · Exploitation of Remote ServicesThe exploit targets the GS1900 web management service and can be used by an unauthenticated attacker with network reachability.

CVE

CVE-2026-107441Zyxel · GS1900-10HP firmware; Zyxel · GS1900-16 firmware; +8 moreflaw tracked as CVE-2026-7273. The new 2.90 Patch 3 firmware fixes a flaw now tracked separately as CVE-2026-107441, which the exploit relies on. It was posted on October 23, and the vendor announced it in an advisory CVE-2026-7273Zyxel · Gs1900-10hp firmware; Zyxel · Gs1900-16 firmware; +8 moreThe earlier fix is the 2.90 Patch 2 firmware, named in a June 16 advisory for a flaw tracked as CVE-2026-7273. The new 2.90 Patch 3 firmware fixes a flaw now tracked separately as CVE-2026-107441, which the exploit

Threat Actors

Red HeronGreyNoise's report described the attackers as the same as, or related to, the group Acronis tracks as Red Heron; this relationship is not confirmed in the article.

Malware

JITTERLYthat Acronis tracks as Red Heron and describes as Chinese-speaking. Acronis linked a backdoor called JITTERLY to Red Heron in an earlier campaign that targeted Gitea servers.

Vendors

Acronisor how the attackers reached them. It says the attackers are the same as, or related to, a group that Acronis tracks as Red Heron and describes as Chinese-speaking. Acronis linked a backdoor called JITTERLY to Red ZyxelZyxel GS1900 network switches that received the vendor's earlier fix for an actively exploited flaw are still open to the exploit attackers used, researchers at Binarly found.

Products

Zyxel GS1900 series switchesZyxel GS1900 network switches that received the vendor's earlier fix for an actively exploited flaw are still open to the exploit attackers used, researchers at Binarly found.

Related Articles