L4 · Septic Tank BlewZyxel · switches · patch bypasszyxel-gs1900-cgi

Zyxel GS1900 needs a second firmware fix after an in-use pre-auth exploit survives Patch 2

CVE-2026-107441 allows unauthenticated commands on ten GS1900 switch models. Binarly links an in-use exploit to a parser flaw still present after the earlier CVE-2026-7273 patch. Install each model’s 2.90(... .3)C0 firmware; restrict management access and investigate exposure. The 996-device campaign count is not a new-CVE victim census.

Disclosed: Nov 3, 2026; Public disclosure date
Severity: CVSS 8.8; 1 CVE tracked here
Splash zone: Ten GS1900 models through model-specific 2.90(... .2)C0 firmware with network-reachable management HTTP; vendor specifies LAN access.; Zyxel · switches · patch bypass
In the wild: Yes; Binarly ties a recovered in-use exploit to this flaw; CCCS also warns of exploitation.

What happened

An unauthenticated attacker who can reach the affected switch’s management CGI can corrupt request parsing and execute operating-system commands. Zyxel describes a LAN-based attacker; Binarly argues that the HTTP path has no protocol-level adjacency requirement. Keep both assessments visible: the vendor’s CVSS 3.1 score is 8.8, while Binarly’s is 9.8, and neither score is a victim count.

Binarly recovered the exploit from infrastructure associated with the JITTERLY/SIXZUT campaign and tested it against the ten firmware releases previously advertised as fixes for CVE-2026-7273. The earlier counter check ran after an attacker-controlled copy; the exploit still worked. Zyxel treats the newly reported missing size check as a separate flaw, CVE-2026-107441. Patch 3 constrains the copy and validates the counter first. All ten model-specific fixed builds are listed above; a firmware filename for another GS1900 model is not interchangeable.

The researcher links the captured exploit to GreyNoise’s earlier campaign evidence involving 996 switches across 48 countries. That historical campaign was initially attributed to CVE-2026-7273. It is not a separately verified census of CVE-2026-107441 victims, nor proof that every listed malware sample was installed on a switch. Binarly’s findings and the Canadian Cyber Centre’s later warning support urgent treatment of real exploitation; the CNA’s earlier CISA assessment still records none. The new identifier must not inherit the older identifier’s KEV entry or federal deadline.

L4 reflects the researcher’s evidence of an in-use pre-authentication exploit and an ineffective earlier fix. Restrict access, apply the correct new firmware and investigate potential prior compromise. The sources do not publish a universal recovery procedure or prove that installing firmware removes every implant; remediation of a compromised deployment may also require trusted recovery and credential replacement with support.

What’s in the bowl

CVE-2026-107441CVSS 8.8

Pre-authentication CGI out-of-bounds write

Zyxel scores the LAN/adjacent-network path CVSS 3.1 8.8. Binarly assesses network reachability without protocol-level adjacency and scores it 9.8; its recovered exploit executes commands as root. The earlier CVE-2026-7273 fix does not stop that exploit.

Fixed versions

Product	Safe from	Note
Zyxel GS1900-8	`2.90(AAHH.3)C0`	Affected through 2.90(AAHH.2)C0
Zyxel GS1900-8HP	`2.90(AAHI.3)C0`	Affected through 2.90(AAHI.2)C0
Zyxel GS1900-10HP	`2.90(AAZI.3)C0`	Affected through 2.90(AAZI.2)C0
Zyxel GS1900-16	`2.90(AAHJ.3)C0`	Affected through 2.90(AAHJ.2)C0
Zyxel GS1900-24	`2.90(AAHL.3)C0`	Affected through 2.90(AAHL.2)C0
Zyxel GS1900-24E	`2.90(AAHK.3)C0`	Affected through 2.90(AAHK.2)C0
Zyxel GS1900-24EP	`2.90(ABTO.3)C0`	Affected through 2.90(ABTO.2)C0
Zyxel GS1900-24HPv2	`2.90(ABTP.3)C0`	Affected through 2.90(ABTP.2)C0
Zyxel GS1900-48	`2.90(AAHN.3)C0`	Affected through 2.90(AAHN.2)C0
Zyxel GS1900-48HPv2	`2.90(ABTQ.3)C0`	Affected through 2.90(ABTQ.2)C0

Crime-scene timeline

Jun 16, 2026
Earlier GS1900 fix addresses CVE-2026-7273
Patch 2 later proves insufficient against the exploit Binarly recovered; this date is not the new flaw’s public disclosure.
Sep 28, 2026
Binarly verifies the captured exploit against all ten earlier fixes
The researcher reports to Zyxel the following day; the vendor confirms a separate vulnerability on October 11.
Oct 22, 2026
Model-specific Patch 3 firmware released
Binarly says parameter lengths and the counter are checked before copying; use the current vendor model matrix.
Nov 3, 2026
Vendor and researcher publish the new vulnerability
Zyxel publishes CVE-2026-107441. Binarly explains the recovered exploit, root-command impact and ineffective older patch.
Nov 4, 2026
Canadian Cyber Centre warns of exploitation
AV26-1114 Update 1 relays open-source reporting of exploitation. The CNA’s CISA assessment still says none as of its November 3 assessment; it does not negate the researcher’s evidence.

Who said what

We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.

Zyxel original GS1900 advisoryPrimaryNovember3 publication, unauthenticated LAN HTTP prerequisite and all ten exact affected/fixed model builds.
Binarly original exploit and patch analysisPrimaryFull rendered original read; in-use recovered exploit, Patch2 bypass, October22 fix, timeline, network indicators, malware hashes and YARA. A plain HTTP reader returned only a shell.
Binarly BRLY-2026-057 original advisoryPrimaryFull rendered original read; root execution, 9.8 network-vector assessment and relationship to earlier exploited flaw. Public article metadata and disclosure table specify November3; the browser-local heading displayed November2.
Canadian Centre for Cyber Security AV26-1114 Update1PrimaryNovember4 update says open-source reporting indicates CVE-2026-107441 exploitation; urges applying vendor updates.
Zyxel CNA CVE-2026-107441 recordPrimaryVendor CVSS3.1 8.8 and adjacent-network vector; published November3. CISA ADP’s dated November3 exploitation-none assessment is retained, distinct from later research/CERT reporting.

Wipe guide

The wipe checklist

0 of 4 sheets used

Match each switch model and install its Patch 3 firmwareInventory the exact model and full running firmware string in its management interface. Back up the configuration securely and download only the matching model’s firmware through Zyxel’s advisory/Download Library. Follow that model’s official upgrade procedure, complete any required restart, then verify the running model-specific .3 build. Do not flash a build for another model or treat Patch 2 as sufficient.
Restrict the management service while arranging upgradesRemove management HTTP access from public or untrusted networks; allow only required administrative sources through the management VLAN and upstream firewall/ACL. The vendor describes a LAN-based attack, while Binarly says reachability to the HTTP service is sufficient without protocol-level adjacency. A login prompt does not prevent this pre-authentication path; restrictions reduce exposure but do not patch it.
Preserve evidence and hunt with the full campaign recordPreserve management HTTP, authentication, firewall and configuration-change records; review unexpected CGI requests and connections. Binarly publishes more than ten indicators: 13 hostnames (p1, p2, p3 and s0–s9 under 981666[.]xyz), four routable IPs (104.223.65[.]148, 203.88.123[.]148, 104.225.153[.]141, 166.88.227[.]181), and associated ports 22, 80, 443, 5432, 6379, 6443, 8080, 8082, 8092, 8833 and 18081. Its p1/p3 entries resolved to loopback 127.0.0.1; loopback alone is not a remote attacker indicator. Check /cgi-bin/dispatcher.cgi, /cgi-bin/httprestorecfg.cgi and /cgi-bin/httpupload.cgi request history, and gs1900_bundle.tar.gz/exp.py where relevant. Use the report’s complete JITTERLY/SIXZUT SHA-256 lists and YARA rules (including configd and /tmp/.X11-unix.lk pivots) for a scoped investigation of associated Linux systems. These campaign indicators do not prove those implants ran on every switch. A match alone does not establish compromise; absent matches do not prove safety.
Re-establish trust before rotating potentially exposed secretsIf suspicious activity or exposure warrants investigation, isolate the device and work with Zyxel/support or your incident-response team to inspect configuration changes and persistence. Rebuild or recover from a trusted state as advised, then replace exposed administrative and configuration-held credentials from a clean management system. Firmware installation alone does not establish that a previously compromised device is clean.