Operators running Zyxel GS1900 access switches got their firmware fix in June. Researchers at Binarly have now shown the update left the bug the attackers were actually using untouched.
The June release, 2.90 Patch 2, addressed CVE-2026-7273, a stack overflow in the switch firmware’s web request handler. The replacement flaw is CVE-2026-107441, an out-of-bounds write in the same program. Binarly rates it 9.8; Zyxel’s own scoring puts it at 8.8.
Zyxel shipped 2.90 Patch 3 on October 23 and published the advisory on November 3. The build is available for all ten affected models, from the GS1900-8 up to the GS1900-48HPv2.
Why the first patch could not help
The web handler copies each request parameter into a fixed area sized for 140 entries. Before Patch 2 it never checked the length of a parameter or how many had arrived. A 140th oversized parameter overruns the area and overwrites the counter holding the total. The next write lands wherever the attacker chooses, which is enough to redirect the function the program is about to call.
Patch 2 added a counter check. It runs after the oversized parameter has already been copied, so by then the counter holds the attacker’s value and the test passes. Binarly says the original exploit works against Patch 2 unchanged.
What defenders should do
Any GS1900 on a Patch 2 build or earlier needs the matching Patch 3 image. There is no workaround in the advisory and no guidance on spotting an intrusion. Where the management interface sits reachable beyond a trusted segment, assume compromise until configuration and credential logs say otherwise.
The GreyNoise telemetry behind this story covered 996 switches in 48 countries, 564 of them still using factory-default logins. Binarly found the exploit itself on a command server tied to the operators.
