Researchers at Binarly say an exploit observed in the wild against Zyxel GS1900 smart-managed switches, initially attributed to CVE-2026-7273, actually targeted a separate out-of-bounds write now tracked as CVE-2026-107441. The discovery explains why the June patch for the earlier flaw did not stop the exploit. Zyxel disclosed the new vulnerability on November 3 and released fixes for ten supported models.
The vulnerability is in the switches’ CGI program. Zyxel says a LAN-based, unauthenticated attacker could send a crafted HTTP request and potentially execute operating-system commands. The company credited Binarly researcher Yegor Vasilenko with reporting it.
Zyxel lists these affected versions and fixes: GS1900-8, 2.90(AAHH.2)C0 and earlier, fixed in 2.90(AAHH.3)C0; GS1900-8HP, 2.90(AAHI.2)C0 and earlier, fixed in 2.90(AAHI.3)C0; GS1900-10HP, 2.90(AAZI.2)C0 and earlier, fixed in 2.90(AAZI.3)C0; GS1900-16, 2.90(AAHJ.2)C0 and earlier, fixed in 2.90(AAHJ.3)C0; GS1900-24, 2.90(AAHL.2)C0 and earlier, fixed in 2.90(AAHL.3)C0; GS1900-24E, 2.90(AAHK.2)C0 and earlier, fixed in 2.90(AAHK.3)C0; GS1900-24EP, 2.90(ABTO.2)C0 and earlier, fixed in 2.90(ABTO.3)C0; GS1900-24HPv2, 2.90(ABTP.2)C0 and earlier, fixed in 2.90(ABTP.3)C0; GS1900-48, 2.90(AAHN.2)C0 and earlier, fixed in 2.90(AAHN.3)C0; and GS1900-48HPv2, 2.90(ABTQ.2)C0 and earlier, fixed in 2.90(ABTQ.3)C0.
Binarly said it recovered the exploit after it had been linked to CVE-2026-7273 and found that it still worked on firmware containing the June fix. The earlier patch addressed a different memory-safety issue, leaving the separate out-of-bounds write available to the exploit.
CVE-2026-7273 was added to CISA’s Known Exploited Vulnerabilities catalog on September 21 after earlier attacks compromised 996 switches across 48 countries, as reported in Abijita’s earlier coverage of the GS1900 campaign. Binarly’s new analysis does not establish that those 996 devices were exploited through CVE-2026-107441.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
