{
  "id": "zyxel-gs1900-cgi",
  "url": "https://ohshit.app/incidents/zyxel-gs1900-cgi/",
  "title": "Zyxel GS1900 needs a second firmware fix after an in-use pre-auth exploit survives Patch 2",
  "level": 4,
  "level_name": "septic-tank-blew",
  "date": "2026-11-03",
  "date_is_approximate": false,
  "updated": null,
  "tags": [
    "Zyxel",
    "switches",
    "patch bypass"
  ],
  "ecosystems": [],
  "summary": "CVE-2026-107441 allows unauthenticated commands on ten GS1900 switch models. Binarly links an in-use exploit to a parser flaw still present after the earlier CVE-2026-7273 patch. Install each model’s 2.90(... .3)C0 firmware; restrict management access and investigate exposure. The 996-device campaign count is not a new-CVE victim census.",
  "splash": "Ten GS1900 models through model-specific 2.90(... .2)C0 firmware with network-reachable management HTTP; vendor specifies LAN access.",
  "wipe": "Install the exact model’s 2.90(... .3)C0 firmware; isolate management and investigate before replacing exposed credentials.",
  "in_the_wild": "yes",
  "source_exception": null,
  "cves": [
    {
      "id": "CVE-2026-107441",
      "score": 8.8,
      "name": "Pre-authentication CGI out-of-bounds write",
      "description": "Zyxel scores the LAN/adjacent-network path CVSS 3.1 8.8. Binarly assesses network reachability without protocol-level adjacency and scores it 9.8; its recovered exploit executes commands as root. The earlier CVE-2026-7273 fix does not stop that exploit."
    }
  ],
  "fixed": [
    {
      "product": "Zyxel GS1900-8",
      "version": "2.90(AAHH.3)C0",
      "status": "Affected through 2.90(AAHH.2)C0"
    },
    {
      "product": "Zyxel GS1900-8HP",
      "version": "2.90(AAHI.3)C0",
      "status": "Affected through 2.90(AAHI.2)C0"
    },
    {
      "product": "Zyxel GS1900-10HP",
      "version": "2.90(AAZI.3)C0",
      "status": "Affected through 2.90(AAZI.2)C0"
    },
    {
      "product": "Zyxel GS1900-16",
      "version": "2.90(AAHJ.3)C0",
      "status": "Affected through 2.90(AAHJ.2)C0"
    },
    {
      "product": "Zyxel GS1900-24",
      "version": "2.90(AAHL.3)C0",
      "status": "Affected through 2.90(AAHL.2)C0"
    },
    {
      "product": "Zyxel GS1900-24E",
      "version": "2.90(AAHK.3)C0",
      "status": "Affected through 2.90(AAHK.2)C0"
    },
    {
      "product": "Zyxel GS1900-24EP",
      "version": "2.90(ABTO.3)C0",
      "status": "Affected through 2.90(ABTO.2)C0"
    },
    {
      "product": "Zyxel GS1900-24HPv2",
      "version": "2.90(ABTP.3)C0",
      "status": "Affected through 2.90(ABTP.2)C0"
    },
    {
      "product": "Zyxel GS1900-48",
      "version": "2.90(AAHN.3)C0",
      "status": "Affected through 2.90(AAHN.2)C0"
    },
    {
      "product": "Zyxel GS1900-48HPv2",
      "version": "2.90(ABTQ.3)C0",
      "status": "Affected through 2.90(ABTQ.2)C0"
    }
  ],
  "checklist": [
    {
      "title": "Match each switch model and install its Patch 3 firmware",
      "hint": "Inventory the exact model and full running firmware string in its management interface. Back up the configuration securely and download only the matching model’s firmware through Zyxel’s advisory/Download Library. Follow that model’s official upgrade procedure, complete any required restart, then verify the running model-specific .3 build. Do not flash a build for another model or treat Patch 2 as sufficient."
    },
    {
      "title": "Restrict the management service while arranging upgrades",
      "hint": "Remove management HTTP access from public or untrusted networks; allow only required administrative sources through the management VLAN and upstream firewall/ACL. The vendor describes a LAN-based attack, while Binarly says reachability to the HTTP service is sufficient without protocol-level adjacency. A login prompt does not prevent this pre-authentication path; restrictions reduce exposure but do not patch it."
    },
    {
      "title": "Preserve evidence and hunt with the full campaign record",
      "hint": "Preserve management HTTP, authentication, firewall and configuration-change records; review unexpected CGI requests and connections. Binarly publishes more than ten indicators: 13 hostnames (p1, p2, p3 and s0–s9 under 981666[.]xyz), four routable IPs (104.223.65[.]148, 203.88.123[.]148, 104.225.153[.]141, 166.88.227[.]181), and associated ports 22, 80, 443, 5432, 6379, 6443, 8080, 8082, 8092, 8833 and 18081. Its p1/p3 entries resolved to loopback 127.0.0.1; loopback alone is not a remote attacker indicator. Check /cgi-bin/dispatcher.cgi, /cgi-bin/httprestorecfg.cgi and /cgi-bin/httpupload.cgi request history, and gs1900_bundle.tar.gz/exp.py where relevant. Use the report’s complete JITTERLY/SIXZUT SHA-256 lists and YARA rules (including configd and /tmp/.X11-unix.lk pivots) for a scoped investigation of associated Linux systems. These campaign indicators do not prove those implants ran on every switch. A match alone does not establish compromise; absent matches do not prove safety."
    },
    {
      "title": "Re-establish trust before rotating potentially exposed secrets",
      "hint": "If suspicious activity or exposure warrants investigation, isolate the device and work with Zyxel/support or your incident-response team to inspect configuration changes and persistence. Rebuild or recover from a trusted state as advised, then replace exposed administrative and configuration-held credentials from a clean management system. Firmware installation alone does not establish that a previously compromised device is clean."
    }
  ],
  "sources": [
    {
      "name": "Zyxel original GS1900 advisory",
      "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026",
      "says": "November3 publication, unauthenticated LAN HTTP prerequisite and all ten exact affected/fixed model builds.",
      "primary": true
    },
    {
      "name": "Binarly original exploit and patch analysis",
      "url": "https://www.binarly.io/blog/zyxel-gs1900-rce-cve-2026-107441",
      "says": "Full rendered original read; in-use recovered exploit, Patch2 bypass, October22 fix, timeline, network indicators, malware hashes and YARA. A plain HTTP reader returned only a shell.",
      "primary": true
    },
    {
      "name": "Binarly BRLY-2026-057 original advisory",
      "url": "https://www.binarly.io/advisories/brly-2026-057",
      "says": "Full rendered original read; root execution, 9.8 network-vector assessment and relationship to earlier exploited flaw. Public article metadata and disclosure table specify November3; the browser-local heading displayed November2.",
      "primary": true
    },
    {
      "name": "Canadian Centre for Cyber Security AV26-1114 Update1",
      "url": "https://www.cyber.gc.ca/en/alerts-advisories/zyxel-security-advisory-av26-1114",
      "says": "November4 update says open-source reporting indicates CVE-2026-107441 exploitation; urges applying vendor updates.",
      "primary": true
    },
    {
      "name": "Zyxel CNA CVE-2026-107441 record",
      "url": "https://cveawg.mitre.org/api/cve/CVE-2026-107441",
      "says": "Vendor CVSS3.1 8.8 and adjacent-network vector; published November3. CISA ADP’s dated November3 exploitation-none assessment is retained, distinct from later research/CERT reporting.",
      "primary": true
    }
  ],
  "headline": null,
  "one_liner": null,
  "in_the_wild_note": "Binarly ties a recovered in-use exploit to this flaw; CCCS also warns of exploitation.",
  "mitigation": null,
  "timeline": [
    {
      "date": "Jun 16, 2026",
      "title": "Earlier GS1900 fix addresses CVE-2026-7273",
      "body": "Patch 2 later proves insufficient against the exploit Binarly recovered; this date is not the new flaw’s public disclosure."
    },
    {
      "date": "Sep 28, 2026",
      "title": "Binarly verifies the captured exploit against all ten earlier fixes",
      "body": "The researcher reports to Zyxel the following day; the vendor confirms a separate vulnerability on October 11."
    },
    {
      "date": "Oct 22, 2026",
      "title": "Model-specific Patch 3 firmware released",
      "body": "Binarly says parameter lengths and the counter are checked before copying; use the current vendor model matrix."
    },
    {
      "date": "Nov 3, 2026",
      "title": "Vendor and researcher publish the new vulnerability",
      "body": "Zyxel publishes CVE-2026-107441. Binarly explains the recovered exploit, root-command impact and ineffective older patch."
    },
    {
      "date": "Nov 4, 2026",
      "title": "Canadian Cyber Centre warns of exploitation",
      "body": "AV26-1114 Update 1 relays open-source reporting of exploitation. The CNA’s CISA assessment still says none as of its November 3 assessment; it does not negate the researcher’s evidence."
    }
  ],
  "body_markdown": "An unauthenticated attacker who can reach the affected switch’s management CGI can corrupt request parsing and execute operating-system commands. Zyxel describes a LAN-based attacker; Binarly argues that the HTTP path has no protocol-level adjacency requirement. Keep both assessments visible: the vendor’s CVSS 3.1 score is **8.8**, while Binarly’s is **9.8**, and neither score is a victim count.\n\nBinarly recovered the exploit from infrastructure associated with the JITTERLY/SIXZUT campaign and tested it against the ten firmware releases previously advertised as fixes for CVE-2026-7273. The earlier counter check ran after an attacker-controlled copy; the exploit still worked. Zyxel treats the newly reported missing size check as a separate flaw, **CVE-2026-107441**. Patch 3 constrains the copy and validates the counter first. All ten model-specific fixed builds are listed above; a firmware filename for another GS1900 model is not interchangeable.\n\nThe researcher links the captured exploit to GreyNoise’s earlier campaign evidence involving **996 switches across 48 countries**. That historical campaign was initially attributed to CVE-2026-7273. It is not a separately verified census of CVE-2026-107441 victims, nor proof that every listed malware sample was installed on a switch. Binarly’s findings and the Canadian Cyber Centre’s later warning support urgent treatment of real exploitation; the CNA’s earlier CISA assessment still records none. The new identifier must not inherit the older identifier’s KEV entry or federal deadline.\n\nL4 reflects the researcher’s evidence of an in-use pre-authentication exploit and an ineffective earlier fix. Restrict access, apply the correct new firmware and investigate potential prior compromise. The sources do not publish a universal recovery procedure or prove that installing firmware removes every implant; remediation of a compromised deployment may also require trusted recovery and credential replacement with support."
}