A significant security flaw in Zyxel GS1900 switches has been exploited by hackers, rendering the recent patch ineffective. Researchers from Binarly discovered that the publicly available exploit targeted a distinct vulnerability, which Zyxel had not addressed in its initial patch. Zyxel has now acknowledged this new flaw, identified as CVE-2026-107441.
Initial Patch Ineffective
Zyxel released a patch aimed at fixing CVE-2026-7273 on June 16, 2026. However, following reports from cybersecurity firm GreyNoise of ongoing attacks, Binarly conducted tests on September 28. Their findings revealed that all ten firmware updates still contained vulnerabilities. Zyxel confirmed the presence of this new flaw on October 11, provided a remedy on October 22, and issued an advisory on November 3.
The vulnerability exists within the dispatcher.cgi web program, carrying a critical severity score of 9.8. It allows attackers to execute commands with root privileges without the need for authentication. Similar weak code was found in httprestorecfg.cgi and httpupload.cgi.
In-depth Analysis of the Exploit
The exploit involves the web page storing request parameters in a fixed memory block of 140 slots, each capable of holding 1,024 bytes. The system copies data before validating the count, resulting in a long value in slot 139 spilling over to overwrite the counter. Attackers can manipulate the counter to a negative value, enabling them to overwrite function pointers and run arbitrary commands. Despite Zyxel’s patch introducing a count check, the vulnerable data copying occurs prior to this check.
Binarly also highlighted inaccuracies in Zyxel’s description of the flaw. The vulnerability resides in global memory, not the stack, and can be exploited over HTTP from any network accessible to the switch. Consequently, Binarly rates the severity higher than Zyxel’s initial 8.8 score.
Global Impact and Recommendations
GreyNoise reported that a single actor compromised 996 GS1900 switches across 48 countries as of August 17. The attacker extracted device settings, hashed root passwords, and network information, with 564 devices still using default credentials. The most affected countries included Italy, the United States, and Taiwan.
The exploit utilized a Python script protected with PyArmor, which retrieved a collector script via TFTP from the attacker’s server and stored stolen data in a web-accessible folder. GreyNoise linked the attacker to the Gitea campaign identified by Acronis as Red Heron, based on shared infrastructure and malware usage.
To mitigate risks, update all GS1900 switches to the latest fix available as of October 22. Restrict web management interfaces to trusted networks and change default passwords immediately. CISA advises monitoring for unusual administrative activities, altered settings, and suspicious web requests. Due to the theft of hashed root credentials, treat any exposed switch as potentially compromised and update passwords accordingly.
Integrating threat intelligence from 16K SOCs can provide the necessary context to swiftly prevent incidents. Security teams should remain vigilant and proactive in safeguarding network infrastructure.
