A flaw in Zyxel GS1900 switch firmware has been found to survive a June security update, raising questions about whether that patch fixed the vulnerability exploited in attacks on 996 switches in 48 countries.
Firmware security company Binarly detailed the finding in research published on November 3, linking it to an exploit that threat intelligence firm GreyNoise had described in September. The vulnerability now carries a new identifier, CVE-2026-107441. It is an out-of-bounds write flaw in the switches' web management program that can allow an unauthenticated attacker to run operating system (OS) commands with root privileges.
The attacks had originally been tied to CVE-2026-7273, which Zyxel fixed on June 16 and described as a stack-based buffer overflow in the same program, rated 8.8. On September 21, GreyNoise reported that an attacker had exploited that flaw against 996 Zyxel GS1900 switches in 48 countries, taking switch configurations, hashed root credentials and networking information.
The US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-7273 to its Known Exploited Vulnerabilities (KEV) catalog the same day.
June Fix Left Vulnerable Code in Place
Binarly analyzed an obfuscated Python exploit that matched the one GreyNoise described. On September 28, the researchers confirmed that all 10 firmware releases shipped as the June fix remained vulnerable to it.
Binarly said the June change added a check, but the check ran only after the unsafe copy had already occurred. The researchers wrote that the change "does not address the vulnerability."
The firm offered two explanations. Either the June patch, its description and its Common Vulnerability Scoring System (CVSS) score were incorrect, or the attacks used a different flaw and CISA's link to CVE-2026-7273 would be wrong.
Either way, Binarly said, all 10 releases advertised as fixes contain the vulnerable code.
Severity Disputed as Zyxel Ships New Firmware
Zyxel rates CVE-2026-107441 at 8.8 and says an attacker must be on the local network to exploit the vulnerability, while Binarly rates it 9.8 and says exploitation requires only network access to the switch's management service.
Binarly said it notified Zyxel on September 29. Zyxel confirmed the flaw on October 11, released a fix on October 22 and published its advisory on November 3.
The flaw affects ten GS1900 models. On the GS1900-8, for example, firmware 2.90(AAHH.2)C0 and earlier is affected and 2.90(AAHH.3)C0 contains the fix.
Zyxel told users to install the updates "for optimal protection." Its advisory lists the June releases among the affected versions, so switches last updated in June still need the new firmware.