Zyxel GS1900 Patch 2 Did Not Stop the Overflow: New CVE-2026-107441 Hits All Ten 'Fixed' Builds

Zyxel has published a second advisory for its GS1900 series switches, covering CVE-2026-107441, an out-of-bounds write in the web CGI program. Binarly, which reported the bug, says it sits in the same parameter parser that Zyxel's Patch 2 was meant to fix for CVE-2026-7273, the flaw CISA added to its Known Exploited Vulnerabilities catalog on 21 September. Binarly says the vulnerability is present in all ten firmware builds Zyxel advertised as fixes. Patch 3 is the fix. Zyxel lists no workaround.

Who is affected

Ten GS1900 models running 2.90 Patch 2 or earlier. Unlisted on-market products are unaffected, per Zyxel.

Severity: 8.8 or 9.8

Zyxel's CNA entry in NVD scores it 8.8 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-787) and describes a LAN-based, unauthenticated attacker able to run OS commands through a crafted HTTP request. NVD lists the record as awaiting analysis. Binarly argues for 9.8: the overflowing object is the global reqParameters structure in .bss, not a stack buffer, and exploitation runs over HTTP with no adjacency requirement, so an attacker only needs network reachability to the management service (AV:N).

Why Patch 2 did not hold

Binarly's binary diff shows Zyxel added a counter check to the parameter parser: stop when the count reaches 140, and clamp a count of 141 or more back to 140. Binarly says the check comes too late. An unbounded copy into entry 139 happens first, so the global counter can be overwritten before it is tested. Per The Hacker News, the parameter store holds 140 parameters and never checks parameter size; Patch 3 checks the counter before copying and limits copy size.

Patch 2 copied first and checked the counter second; Patch 3 reverses the order and limits the copy size.

Binarly offers two readings. Either the Patch 2 change is the (incorrect) fix for CVE-2026-7273, and that CVE's description and score are wrong too. Or the change addresses a different bug, in which case the exploitation GreyNoise documented used a different vulnerability and CISA's link to CVE-2026-7273 is mistaken.

Exploitation

GreyNoise reported an actor exploiting CVE-2026-7273 against 996 GS1900 switches in 48 countries, taking configurations, hashed root credentials and network information. The PyArmor-obfuscated Python exploit it described matches the one Binarly analysed, which corrupts the parameter counter and supports a GOT overwrite mode and a stack target mode. The Hacker News reports 564 of the 996 switches used factory-default credentials, and that Binarly found the exploit on a server that also acted as command server for JITTERLY, a backdoor Acronis tied to the Red Heron group; GreyNoise says the operators may be the same as or related to Red Heron. The JITTERLY link comes from that report, not from Binarly's advisory. CVE-2026-107441 itself is not in KEV, and NVD's SSVC entry records no exploitation. Neither source says the attacked switches ran Patch 2.

What to do

• Upgrade every listed model to its .3 build from the table. Do not treat Patch 2 as a fix for either CVE.
• Keep the web management interface off untrusted networks, including flat LANs with guest or IoT segments. Binarly's AV:N reading means adjacency should not be relied on.
• Change factory-default credentials and rotate any that may have been exposed. Stolen data included hashed root credentials.
• On switches that ran Patch 2 or earlier on a reachable network, review configurations for unexpected changes.

Related: Zyxel GS1900 switch overflow exploited on 996 devices, now in CISA KEV.

Sources

• Zyxel security advisory
• NVD CVE-2026-107441
• Binarly BRLY-2026-057
• The Hacker News