Zyxel GS1900 Patch Fails to Block Zero-Day Exploit

If your Zyxel GS1900 switch runs the 2.90 Patch 2 firmware, it is still exposed. Researchers at Binarly found that the exploit attackers used still works against the earlier fix. Zyxel has now released 2.90 Patch 3 for 10 models, as The Hacker News reports.

The exploit lets anyone who can reach the switch's web management interface run commands without logging in. Update first, then tighten access.

What happened: the first fix missed the real bug

Zyxel's June 16 advisory named 2.90 Patch 2 as the fix for CVE-2026-7273 (as reported by The Hacker News). Binarly says that fix does not stop the exploit. The new Patch 3 firmware fixes a flaw now tracked separately as CVE-2026-107441, which the exploit relies on.

The bug is an out-of-bounds write in the program that handles web requests. It stores request parameters in a fixed area that holds 140 parameters. It never checked the size of a parameter.

The exploit sends an oversized 140th parameter. That overwrites the parameter counter, so the next parameter lands outside the area. The attacker can then swap in a function that runs their command.

Patch 2 added a check on the counter, but it runs after the oversized parameter is copied. By then the counter holds the attacker's value. Binarly says the exploit works against Patch 2 unchanged. Patch 3 checks the counter before each copy and limits the copy size.

Binarly reported the flaw on September 29. Patch 3 was posted on October 23.

Which GS1900 models need the Patch 3 build

Binarly says all 10 Patch 2 builds are affected. Anything on Patch 2 or earlier needs the Patch 3 build for its model.

Match the code in the brackets (such as AAHL) to your model. A GS1900-24 on 2.90(AAHL.2)C0 is exposed. It should move to 2.90(AAHL.3)C0.

How serious it is and whether attackers use it

This is serious. Binarly rates the flaw 9.8 out of 10 on CVSS, and says commands run as root. Zyxel's CVE entry scores it 8.8.

The two sources also differ on who can attack. Zyxel describes a "LAN-based, unauthenticated attacker". Binarly says "an attacker only needs network reachability to the management service". Treat any path to the management page as a risk.

Attacks on the earlier CVE were reported. GreyNoise said on September 21 that attackers took data from 996 GS1900 switches around August 17. The data included switch configurations, hashed root credentials and network information. Of those 996 switches, 564 still used factory-default credentials. Binarly says the exploit GreyNoise described matches the one it found.

There is a gap in the evidence. Neither GreyNoise nor Binarly says the attacked switches were running Patch 2. Binarly offers two explanations: either Patch 2 was a faulty fix for CVE-2026-7273, or the attacks exploited a different flaw from the one CISA listed.

GreyNoise says the attackers are the same as, or related to, a group Acronis tracks as Red Heron and describes as Chinese-speaking. Binarly found the exploit on September 17 in an open folder on a server that also acted as a command server for JITTERLY. That is a backdoor Acronis linked to Red Heron in an earlier campaign against Gitea servers.

CISA added CVE-2026-7273 to its KEV catalog on September 21. For the new flaw, Zyxel's advisory does not say whether it has been exploited, and CISA's KEV catalog did not list CVE-2026-107441 at its last update.

Binarly says it will soon publish a smaller proof-of-concept exploit. Expect copycat scanning once it appears.

What to do now, in order

1. Find every GS1900. Check your inventory, then scan for web management pages.

2. Read the firmware version in each switch's web interface and compare it to the table above.

3. Install the Patch 3 build for your model from Zyxel's firmware release notes.

4. Move management to a separate VLAN or subnet that only admins can reach. Zyxel lists no workaround, so treat this as an extra layer, not a fix.

5. Replace default credentials. The attackers collected hashed root credentials, so set new, unique passwords after updating.

6. Look for signs of compromise. Patching alone does not tell you whether someone is already in.

Commands to check exposure

Find devices answering on the web ports. Replace the subnet with your own.

nmap -p 80,443 --open -sV 192.168.1.0/24

Grab the response headers of a suspect switch to confirm it is a management page.

curl -skI https://192.168.1.10/ | head -n 5

If the switch sits on a different subnet from your users, a Linux gateway can limit who reaches it. A FORWARD rule only filters traffic that crosses the gateway. It does nothing for devices on the same LAN as the switch, so move the switch first. The addresses here are examples.

iptables -I FORWARD -p tcp -m multiport --dports 80,443 -d 192.168.1.10 ! -s 192.168.50.0/24 -j DROP

GreyNoise says the collected data was left on the switch to be picked up. So check inbound connections to the management page, not only outbound traffic. Look for unfamiliar source addresses.

grep 'DST=192.168.1.10' /var/log/firewall.log | grep -E 'DPT=(80|443)' | grep -v 'SRC=192.168.50.'

Then look for outbound traffic from the switch's own address. Switches should rarely start connections.

grep 'SRC=192.168.1.10' /var/log/firewall.log | grep -v 'DPT=53'

GreyNoise says attackers pushed a data-collection script onto the switches. Unexpected downloads or internet connections from a switch deserve a closer look.

A quick triage example

Say you manage a small office with a GS1900-24 and a GS1900-8HP. Both run Patch 2.

• First: the GS1900-8HP. It is on the main LAN with user devices and still uses the factory password. Move its management to a separate VLAN, update to 2.90(AAHI.3)C0, then set a new password.

• Second: the GS1900-24. It sits on a management VLAN and has a changed password. Update it to 2.90(AAHL.3)C0 right after.

A switch that many devices can reach, with default credentials, is the highest risk. Start there.

What IT and security learners can take from this

A patch can address the wrong part of a bug, so verify fixes instead of assuming them. Here the first fix checked a counter but not the size of the input. Also, management interfaces should never be open to every device, and default passwords are a common way in. These habits, along with vulnerability management and incident response, are covered in the CompTIA CySA+ CS0-003 voucher ($224.99, emailed within 12 hours). Read our CS0-003 retirement guide before you book. For the earlier attacks, see our Zyxel zero-day coverage.

Sources

• Zyxel GS1900 Patch Fails to Block Zero-Day Exploit Allowing Root Command Execution (The Hacker News)