CybersecurityVulnerability Management

Zyxel Patch Fails to Eradicate Switch Flaw

Analyst 207||Source: InfoSecMag
Network switch on a rack with cables connected in a dimly lit data center.

996 Zyxel GS1900 switches in 48 countries were reported as compromised in September — and a follow-up technical review shows the June firmware update intended to stop those intrusions left the underlying vulnerable code in place.

Binarly's technical finding and the new CVE-2026-107441

Firmware security firm Binarly published research on November 3 that links an out-of-bounds write flaw in the GS1900 series' web management program to the attacks described in September. Binarly gave the issue the identifier CVE-2026-107441 and said the flaw can allow an unauthenticated attacker to run operating system commands with root privileges.

Binarly analyzed an obfuscated Python exploit that matched the exploit GreyNoise described in September and concluded that the code shipped in the June patch releases remained vulnerable. The firm said the June change introduced a check that ran only after an unsafe copy had already occurred and, in its words, "does not address the vulnerability."

GreyNoise reporting, CISA action, and the September intrusions

On September 21 GreyNoise reported that an attacker had exploited a vulnerability against 996 Zyxel GS1900 switches in 48 countries, taking switch configurations, hashed root credentials and networking information. That incident had been tied to CVE-2026-7273, which Zyxel said it fixed on June 16 and described as a stack-based buffer overflow in the same web management program, rated 8.8.

The US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-7273 to its Known Exploited Vulnerabilities (KEV) catalog on September 21, the same day GreyNoise published its findings.

How the June fix left vulnerable code in place

Binarly inspected the June firmware releases that Zyxel shipped as fixes and reported on September 28 that all ten patched releases still contained the vulnerable code. The firm's analysis of the exploit and of the patched binaries found the added validation ran only after the unsafe memory copy operation — a timing that, according to Binarly, meant the June change "does not address the vulnerability."

Binarly offered two possible readings of the record: either the June patch, its description and its Common Vulnerability Scoring System (CVSS) score were incorrect, or the attacks used a different flaw and CISA's link to CVE-2026-7273 would be wrong. Regardless of which interpretation is correct, Binarly emphasized that all ten releases advertised as fixes contained the vulnerable code.

Zyxel’s timeline, severity rating, and new firmware

Binarly said it notified Zyxel on September 29. Zyxel confirmed the newly reported flaw on October 11, released a firmware fix on October 22 and published its advisory on November 3.

Zyxel rates CVE-2026-107441 at 8.8 and states that "an attacker must be on the local network to exploit the vulnerability." Binarly assigns the issue a 9.8 severity and says exploitation requires only network access to the switch's management service. Zyxel's advisory lists the June releases among the affected versions, meaning switches updated in June still require the October firmware.

The flaw affects ten GS1900 models. For the GS1900-8 specifically, firmware 2.90(AAHH.2)C0 and earlier are affected; version 2.90(AAHH.3)C0 contains the fix. Zyxel told users to install the updates "for optimal protection."

What this means for technologists and procurement leaders

  • Technologists and security teams: Binarly's finding indicates that firmware images labeled and advertised as fixes may still contain exploitable code; teams should verify that devices run the Zyxel versions released on October 22 (for affected GS1900 models) and treat June-updated switches as still requiring the October update.
  • Procurement and asset owners: The advisory explicitly lists June releases among affected versions, so purchases or maintenance records showing a June update do not guarantee remediation. Owners of GS1900 models should confirm exact firmware builds, for example moving from 2.90(AAHH.2)C0 to 2.90(AAHH.3)C0 on the GS1900-8 where applicable.

The published sequence of events leaves a narrow but consequential discrepancy: the June fix that Zyxel described as addressing CVE-2026-7273 appears not to have removed the exploitable code Binarly identified, prompting two competing explanations documented by Binarly — either the June patch did not do what it claimed, or the September attacks exploited a different flaw now tracked as CVE-2026-107441. For system owners of affected GS1900 switches the practical step is clear in Zyxel's advisory: install the October firmware for "optimal protection." The broader technical question — which specific code path the September intrusions used and how the June release came to miss it — remains the point at issue in the published analyses.

Original story

Emerging ThreatsNetwork SecuritySupply ChainVulnerabilityIot SecurityFirmware SecurityZyxelCVE-2026-107441BinarlyGS1900 Switch
Related Intelligence

Continue Reading

Cybersecurity team analyzes threat data in operations center with city view.

AI Accelerates Zero-Day Discovery, Raises Patching Pressures Apache OFBiz Flaws Expose Pre-Auth RCE, Account Takeover Risks DreamHost Breach Exposes FTP, Webmail Credentials DeFi Sites Hijacked via Name.com DNS Compromise Stolen Cloud App Credentials Abused for 27 Organizations

Defensive AI-cyber tools have shrunk the vulnerability window, speeding up patching processes - but only if properly configured, as misconfigured defenses can also arm attackers. AI now accelerates flaw discovery, cutting the window from zero-day to n-day vulnerabilities, benefiting defenders who are prepared.

Analyst 207
Service desk representative sitting at a desk, looking at a computer screen or paper with a thoughtful expression.

Service Desks Exposed to Social Engineering Threats

Service desks can be a soft spot for security, especially when they use knowledge-based verification methods that can be easily exploited by attackers who gather information from public sources like social media and LinkedIn profiles. This common vulnerability leaves organizations open to social engineering threats, despite having robust security measures in place.

Analyst 207
Laptop on a desk with a browser window open to Claude.ai interface, conveying vulnerability.

Anthropic's Claude Exposes Remote Code Execution Flaw

A security researcher discovered a vulnerability in Anthropic's Claude products that allows malicious browser extensions to take control of the AI agent, sending commands to compromise the user's computer. This flaw enables a classic escalation of privileges, giving attackers unrestricted access to the operating system and its files.

Analyst 207
Airline staff work at computer stations behind a large blank screen.

Exposure Management Platforms Face Five Critical Tests

Can exposure management platforms truly keep up with evolving threats, or will they fall short when it matters most? To pass the test, they must navigate five critical challenges that put their effectiveness to the ultimate proof.

Analyst 207