Binarly finds Zyxel GS1900 fix leaves attack path open

Administrators of 10 Zyxel GS1900 switch models need a second firmware update after Binarly found that the earlier security patch still permits an exploit used by attackers, The Hacker News reported. The replacement, 2.90 Patch 3, addresses a vulnerability that lets an attacker reach the switch’s web management service and execute commands without authentication.

The finding affects switches running 2.90 Patch 2 as well as older firmware. Patch 2 was the remedy identified in Zyxel’s June 16 advisory for CVE-2026-7273. The surviving vulnerability has a separate identifier, CVE-2026-107441; Zyxel made Patch 3 available on October 23 and announced it in an advisory earlier this week.

Zyxel describes the attacker as LAN-based and unauthenticated. Binarly says access to the management service over the network is sufficient, and that successful exploitation gives the attacker root command execution. The researchers assign a CVSS severity score of 9.8 out of 10, while Zyxel’s CVE entry gives it 8.8.

An exploit already in attackers’ hands

The evidence connecting the vulnerability to attacks predates Binarly’s September 29 disclosure to Zyxel. The researchers discovered the exploit on September 17 in an openly accessible folder on a server also used to command the JITTERLY backdoor. They describe the vulnerability as a zero-day because attackers already possessed a working exploit.

GreyNoise, which observes attack traffic through sensors, disclosed on September 21 that attackers had taken data from 996 GS1900 switches around August 17. It identified CVE-2026-7273 as the vulnerability involved. Binarly says GreyNoise’s description matches the exploit it recovered, although the firmware versions on the attacked switches—and how attackers reached them—remain unspecified.

The operation used the exploit to place a collection script on switches, then staged the gathered information for retrieval. That information comprised configurations, root credential hashes and network details. Factory-default credentials were still in use on 564 of the 996 devices.

GreyNoise assessed that the attackers were either the group Acronis tracks as Red Heron or associated with it. Acronis describes Red Heron as Chinese-speaking and previously connected it to JITTERLY in a campaign against Gitea servers.

Two missing checks, two vulnerability identifiers

Binarly’s analysis centers on the switch software that processes web requests. Its parameter storage has capacity for 140 entries, but individual parameter lengths were not checked. Before Patch 2, the software also lacked a check on the number of stored parameters.

The exploit turns those omissions into a sequence of memory writes. An oversized parameter in position 140 spills beyond its storage and changes the counter used to track parameters. With that counter under attacker control, the following parameter lands outside the intended memory area. The attacker can then redirect an upcoming function call to execute a command.

Patch 2 introduced a counter check too late in that sequence: the copy operation had already allowed the oversized parameter to corrupt the counter. The subsequent check therefore examined a value supplied by the attacker. Binarly says its recovered exploit needed no modification to work against Patch 2.

The researchers validated the exploit using both emulated firmware and physical hardware, without identifying the hardware model. The exploit’s supported-firmware list explicitly includes Patch 2 for the GS1900-24, while Binarly’s advisory identifies all 10 listed Patch 2 builds as vulnerable.

Binarly says Zyxel explained the two CVE identifiers by distinguishing the missing counter check, covered by CVE-2026-7273, from the missing length check, now CVE-2026-107441. The researchers consequently offer two interpretations: the original vulnerability received an inadequate fix, or the attacks used a vulnerability different from the one CISA cataloged.

Patch 3 moves counter validation ahead of the copy operation and restricts how much data can be copied. Binarly says this resolves the flaw and plans to release a smaller proof-of-concept exploit.

The replacement firmware

The Hacker News reports these model-specific affected and fixed releases from Zyxel’s advisory:

CISA entered CVE-2026-7273 in its Known Exploited Vulnerabilities catalog on September 21, the day GreyNoise publicized the attacks. Its September 24 remediation deadline applied to covered U.S. federal civilian agencies. Patch 2 was the vendor fix identified at that time.

The catalog entry requires vendor-directed mitigation under BOD 26-04 and compliance with CISA’s forensic triage requirements. It also calls for assessing each asset’s internet exposure, following applicable cloud-service guidance, or discontinuing use if mitigations are unavailable. Forensic triage is marked “Yes”; ransomware campaign use is “Unknown.” The November 4 catalog does not list CVE-2026-107441.

The Hacker News reports that Zyxel’s advisory offers no workaround or instructions for checking suspected compromise, and does not establish whether the update removes an attacker’s existing access. Administrators with any affected build should install their model’s exact Patch 3 release, available alongside Zyxel’s firmware release notes.