Zyxel patches GS1900 switch flaw CVE-2026-107441 that bypassed the earlier fix
Zyxel issued firmware for CVE-2026-107441, an out-of-bounds write in GS1900 switches that bypassed the incomplete fix for CVE-2026-7273 — the flaw GreyNoise tied to 996 compromised devices.
Zyxel has released firmware for CVE-2026-107441, an out-of-bounds write in the web management CGI of its GS1900 smart-managed switches. The vendor's advisory, dated November 3, says the flaw "could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request." See the NVD entry at CVE-2026-107441.
The news here isn't a fresh bug — it's a fix that didn't hold. CVE-2026-107441 bypasses the patch Zyxel shipped in June for CVE-2026-7273, the stack buffer overflow behind a campaign that compromised nearly 1,000 switches.
What's affected
The advisory names ten GS1900 models and the firmware that fixes each one:
- GS1900-8 — fixed in
2.90(AAHH.3)C0 - GS1900-8HP —
2.90(AAHI.3)C0 - GS1900-10HP —
2.90(AAZI.3)C0 - GS1900-16 —
2.90(AAHJ.3)C0 - GS1900-24 —
2.90(AAHL.3)C0 - GS1900-24E —
2.90(AAHK.3)C0 - GS1900-24EP —
2.90(ABTO.3)C0 - GS1900-24HPv2 —
2.90(ABTP.3)C0 - GS1900-48 —
2.90(AAHN.3)C0 - GS1900-48HPv2 —
2.90(ABTQ.3)C0
All earlier .2)C0 builds are vulnerable. Zyxel says "on-market products not listed in the table remain unaffected." The firmware shipped on October 22, per Bleeping Computer, two weeks before the advisory.
Exploitation status
Zyxel's advisory makes no claim of exploitation for CVE-2026-107441 itself. The exploitation on record belongs to the flaw it supersedes. GreyNoise observed attacks on GS1900 switches from around August 17 and disclosed them on September 21, reporting 996 compromised devices across 48 countries and attribution to a suspected Chinese-speaking actor it tracks as Kapibala. The attackers pulled configuration files, network data, and hashed root credentials.
The link between the two CVEs comes from Binarly, which found an obfuscated Python exploit in exposed attacker infrastructure and confirmed on September 28 that it still worked against all ten firmware builds Zyxel had patched for CVE-2026-7273. Binarly reported that to Zyxel on September 29; Zyxel confirmed the new flaw on October 11. In other words, devices patched in June were still exploitable until the October firmware.
Action checklist
- Inventory every GS1900 switch and check its firmware against the table above. A June patch is not enough — you need the
.3)C0build for your model. - Flash the fixed firmware. These are LAN-reachable management interfaces; treat an unpatched switch on any routable segment as exposed.
- If a switch ran vulnerable firmware while reachable, rotate its credentials and any that were stored or transited it — configs and hashed root creds were in scope of the August campaign.
- Remove the switch management plane from general user VLANs; restrict it to a management network.
Context
This is an incomplete-patch story, not a novel one — the June fix narrowed the input but left a reachable out-of-bounds write. GreyNoise's reporting ties the Kapibala operator to the same cluster that earlier mass-scanned WordPress installations via CVE-2026-63030, which we covered in WordPress CVE-2026-63030 "wp2shell" pre-auth RCE. Opportunistic actors revisit a vulnerability class once the first patch proves brittle; a switch that was "patched in June" is exactly the kind of asset that drops off the remediation list and stays online.