Title: Zyxel’s Earlier GS1900 Patch Doesn’t Stop the Exploit — New Patch 3 Firmware Fixes It as CVE-2026-107441
Summary: GS1900 series switches that installed Zyxel’s June fix for an actively exploited flaw remain open to pre-authentication root code execution: the patch (2.90 Patch 2, for CVE-2026-7273, released June) added a counter check to the switch’s CGI-based web program, but the check runs only after an oversized parameter has already been copied — overrunning the fixed parameter area in memory and letting an attacker swap the function the program calls for one that runs their command. Binarly, which reported the residual flaw to Zyxel on September 29 and disclosed it this month, rates the out-of-bounds write 9.8 (network-reachable management service, unauthenticated — against Zyxel’s “LAN-based” 8.8 description) and says an attacker “only needs network reachability to the management service.” Zyxel’s November 3 advisory issues new 2.90 Patch 3 firmware as the fix for ten models: GS1900-8, 8HP, 10HP, 16, 24, 24E, 24EP, 24HPv2, 48 and 48HPv2, each from affected “2.90(XX.2)C0 and earlier” to a “.3” build; switches on Patch 2 or earlier need the new build for their model. The flaw comes amid real exploitation of its predecessor: GreyNoise reported in September that a malware campaign (“Kapibala”) used a novel exploit of CVE-2026-7273 to exfiltrate sensitive data from 996 GS1900 switches across 48 countries, with a timeline entry for August 17; CISA added CVE-2026-7273 to its KEV catalog on September 21. Zyxel’s advisory lists no workaround and does not say whether updating removes access an attacker may already have — organizations running these switches should patch to Patch 3 immediately, restrict who can reach the management interface, and treat previously internet-reachable devices as potentially compromised.
References: