cyber.hendryadrian.com
Vulnerability & Exploit · socradar.io

Zyxel Releases Patch 3 for Exploited GS1900 Zero-Day

· Original article ↗

Summary

Zyxel released Patch 3 for 10 GS1900 switch models to fix an out-of-bounds write that reportedly enabled command execution and data collection. Patch 2 did not close the flaw; researchers reported 996 affected switches.

Key points

  • CVE-2026-107441 affects 10 Zyxel GS1900 models and allows an unauthenticated attacker to run OS commands with root privileges, according to the article.
  • The flaw is in dispatcher.cgi: an oversized request parameter can overwrite a counter and redirect execution.
  • Patch 2 checked the counter only after copying the parameter; Patch 3 checks before copying and limits the copy size.
  • Researchers reported that an exploit was used against 996 GS1900 switches in 48 countries to collect configurations, hashed root credentials, and network information.
  • The researchers did not establish which firmware the affected switches ran or whether they had Patch 2; the article says no GS1900-specific indicators of compromise were published.
  • Zyxel lists no workaround. The article recommends installing the model-specific Patch 3 build, restricting management access, rotating exposed credentials, and reviewing potentially compromised switches.

Article Details

Vulnerability Types
  • Out-of-bounds write caused by an oversized HTTP request parameter
  • Stack-based buffer overflow in the GS1900 CGI program
Severity
Zyxel rates CVE-2026-107441 CVSS 3.1 8.8 with an adjacent attack vector; Binarly rates it 9.8.
Affected Versions
  • Zyxel GS1900-8: 2.90(AAHH.2)C0 and earlier
  • Zyxel GS1900-8HP: 2.90(AAHI.2)C0 and earlier
  • Zyxel GS1900-10HP: 2.90(AAZI.2)C0 and earlier
  • Zyxel GS1900-16: 2.90(AAHJ.2)C0 and earlier
  • Zyxel GS1900-24: 2.90(AAHL.2)C0 and earlier
  • Zyxel GS1900-24E: 2.90(AAHK.2)C0 and earlier
  • Zyxel GS1900-24EP: 2.90(ABTO.2)C0 and earlier
  • Zyxel GS1900-24HPv2: 2.90(ABTP.2)C0 and earlier
  • Zyxel GS1900-48: 2.90(AAHN.2)C0 and earlier
  • Zyxel GS1900-48HPv2: 2.90(ABTQ.2)C0 and earlier
Exploitation Status
active
Exploit Availability
unknown
Patch Status
available
Workarounds
  • Restrict access to the web management interface to a dedicated management network and ensure it is not reachable from the internet.

MITRE ATT&CK

T1005 · Data from Local SystemThe dropped script collected switch configurations, hashed root credentials, and network information.T1059 · Command and Scripting InterpreterThe exploit can redirect execution to an attacker-chosen OS command, which runs with root privileges.T1074.001 · Local Data StagingThe collected output was left on the switch for later retrieval.T1105 · Ingress Tool TransferAttackers used the exploit to drop a data-gathering script onto affected switches.T1190 · Exploit Public-Facing ApplicationThe exploit targets the GS1900 web management interface through its dispatcher.cgi request handler.

CVE

CVE-2026-107441Zyxel · GS1900-10HP firmware; Zyxel · GS1900-16 firmware; +8 moreZyxel has released new firmware for 10 GS1900 switch models to fix CVE-2026-107441, an out-of-bounds write that lets an unauthenticated attacker run OS commands on the switch.CVE-2026-7273Zyxel · GS1900-10HP firmware; Zyxel · GS1900-16 firmware; +8 morefound and reported the issue, say the June release (2.90 Patch 2) fixed only part of the bug behind CVE-2026-7273, the earlier GS1900 flaw that CISA added to its Known Exploited Vulnerabilities (KEV) catalog in

Threat Actors

Red HeronAcronis tracks this group as Red Heron. Researchers assess that the actor behind the GS1900 activity is the same as, or related to, Red Heron; this relationship is not stated as confirmed.

Malware

JITTERLYBinarly found the GS1900 exploit on September 17 in an open directory on a server that also acted as C2 for the JITTERLY backdoor, which Acronis had linked to Red Heron’s Gitea campaign.

Vendors

ZyxelZyxel has released new firmware for 10 GS1900 switch models to fix CVE-2026-107441, an out-of-bounds write that lets an unauthenticated attacker run OS commands on the switch.

Products

Zyxel GS1900 series switchesZyxel has released new firmware for 10 GS1900 switch models to fix CVE-2026-107441, an out-of-bounds write that lets an unauthenticated attacker run OS commands on the switch.

Related Articles