996 GS1900 switches had data taken around August 17, GreyNoise reported on September 21 — and researchers at Binarly now say many of those devices would have remained vulnerable even after Zyxel's earlier fix.
GreyNoise, Binarly, and the timeline of discovery
GreyNoise published an attack report on September 21 tying data theft from 996 Zyxel GS1900 switches to an exploited vulnerability tracked as CVE-2026-7273. Binarly researchers say they found an exploit matching GreyNoise's description, discovered an additional flaw on September 17 in an open folder on a server that also acted as a command server for a backdoor called JITTERLY, and reported the flaw to Zyxel on September 29. Zyxel posted new firmware builds — labeled 2.90 Patch 3 — on October 23 and announced them in a subsequent advisory.
How the exploit works and why Patch 2 failed
Binarly's technical analysis traces the root cause to the web-request handler on the switches: an out-of-bounds write in code that stores request parameters in a fixed-area buffer sized for 140 parameters. The program did not check parameter size and, prior to Patch 2, also did not check how many parameters it had stored. The exploit sends a 140th parameter that is too large, overrunning the buffer and corrupting the program's parameter counter. A subsequent parameter is then written outside the buffer in a way that lets an attacker swap the function the program will call for one that executes the attacker's command.
Patch 2 added a counter check, but according to Binarly the check occurs after the oversized parameter has been copied — by then the counter already reflects the attacker's value, so the check does not stop the write. Binarly tested the exploit on emulated firmware and on real hardware (the researchers do not specify which model) and say the exploit works against Patch 2 without modification. Zyxel told the researchers it treats the missing counter check as the CVE-2026-7273 issue and the missing size check as a separate flaw, now tracked as CVE-2026-107441.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleWhat Patch 3 changes — and what remains unclear
Zyxel's 2.90 Patch 3 firmware, posted October 23, addresses the newly reported flaw (CVE-2026-107441) across 10 GS1900 models. Binarly reports that in the Patch 3 code the counter is checked before a parameter is copied and the copy is limited in size, which the researchers say fixes the vulnerability. Zyxel's security advisory lists the affected and fixed firmware builds for each model and posts the builds with their release notes.
However, Zyxel's advisory lists no workaround for owners who cannot update immediately, does not state whether applying the Patch 3 update will remove access an attacker may already have, and does not advise what owners should check if a switch may have been compromised. CISA added CVE-2026-7273 to its Known Exploited Vulnerabilities catalog on September 21 and gave federal agencies until September 24 to apply the vendor's Patch 2 fix; as of the latest KEV data update, CISA does not list CVE-2026-107441.
What the attackers did and how severe the researchers rate it
GreyNoise reported that attackers used the exploit to download a data-collection script onto compromised switches and left the harvested data to be picked up. The collected data included switch configurations, hashed root credentials, and network information. Of the 996 switches GreyNoise observed, 564 still used factory-default credentials.
Binarly characterizes the flaw as a zero-day, says an attacker only needs network reachability to the management service (Zyxel describes the issue as a "LAN-based, unauthenticated attacker"), and reports that commands run with root privileges. Binarly gives the flaw a 9.8/10 CVSS severity rating; Zyxel's CVE entry lists 8.8.
What this means for technologists, federal agencies, and network operators
- Technologists and security teams: Confirm which GS1900 models you run, check Zyxel's advisory for the specific 2.90 Patch 3 build for your model, and apply the posted firmware and release notes. Be aware that Binarly's analysis indicates Patch 2 does not block the exploit without the additional size-and-order checks introduced in Patch 3.
- Federal agencies and regulators: CISA included CVE-2026-7273 on its KEV list with an early-September remediation deadline tied to Patch 2; however, the newly tracked CVE-2026-107441 is not in KEV as of the latest update. Agencies should reconcile inventory and deployment status against Zyxel's advisory and the new Patch 3 builds.
- Network operators and small-to-medium enterprises: GreyNoise's finding that many compromised devices used factory-default credentials underscores the added risk when management interfaces are reachable. Zyxel's advisory offers no workaround for owners unable to update immediately and does not say whether updating removes existing attacker access, so operators should treat exposed management interfaces as high-priority for inspection.
Binarly says it will soon publish a smaller proof-of-concept exploit. Until owners both confirm Patch 3 deployment and verify whether previously compromised devices still exhibit unauthorized access, a brittle patch cycle — one that fixes a symptom but leaves the exploit path intact until the follow-up update — will continue to complicate remediation and risk assessment for the GS1900 line.
