The Zyxel GS1900 network switches, previously patched for a known vulnerability, remain susceptible to exploitation, as identified by researchers from Binarly. This ongoing security concern affects the web management interface of the switches, allowing unauthorized command execution without the need for user login. Zyxel has issued a new firmware update to address this critical flaw.
Details of the Vulnerability
The initial patch, known as the 2.90 Patch 2 firmware, was released following a June advisory addressing CVE-2026-7273. However, the newly identified vulnerability, separately tracked as CVE-2026-107441, necessitated the release of a subsequent patch, 2.90 Patch 3, on October 23. This update aims to close the security gap exploited by attackers.
Binarly researchers, who disclosed the flaw to Zyxel on September 29, highlight it as a zero-day vulnerability. Notably, exploits were already in use prior to the disclosure. The cybersecurity firm GreyNoise reported data exfiltration incidents involving 996 GS1900 switches, starting around mid-August, which they linked to the original CVE-2026-7273 vulnerability.
Firmware Update Requirements
Zyxel has provided specific details regarding the affected models and necessary firmware updates. Ten GS1900 models require the latest firmware to secure the devices against potential exploits. The advisory lists the affected and fixed firmware versions, with Patch 3 being crucial for protection.
Switches running the 2.90 Patch 2 or earlier versions need immediate updating to the new Patch 3 build. Although Zyxel’s advisory lacks a workaround for those unable to update, it is imperative for administrators to implement the new firmware as soon as possible to mitigate risks.
Technical Insights and Attack Analysis
Binarly’s analysis attributes the flaw to improper handling of web requests, specifically an out-of-bounds write issue. The vulnerability allows an attacker to modify the function calls made by the switch’s program by sending a maliciously crafted parameter, bypassing security checks.
The previous patch attempted to address this by adding a counter check, but it was ineffective as the check occurred too late in the process. The Patch 3 update corrects this by implementing pre-copy checks and size limitations to prevent the exploit.
GreyNoise’s findings reveal that attackers used the exploit to install data-collection scripts on vulnerable switches, compromising configuration details and credentials. The report associates these activities with a group known as Red Heron, suspected to have ties to previous campaigns targeting Gitea servers.
Conclusion and Future Measures
The persistence of this vulnerability underscores the necessity for constant vigilance and timely updates in network security practices. Zyxel’s swift response with the Patch 3 update highlights the importance of addressing newly discovered flaws promptly. As cyber threats evolve, continuous monitoring and proactive measures remain essential for safeguarding network infrastructure.
