Zyxel's June patch still runs attacker commands as root

Binarly’s researchers found that the GS1900 firmware Zyxel shipped in June to close an actively exploited flaw is still open to the same exploit. The check the fix added runs after the attacker’s oversized data is already in memory, and the exploit still ends in an unauthenticated command running as root on the switch’s web management interface.

The bug is an out-of-bounds write in the program that handles web requests. It stores each request parameter in a fixed buffer sized for 140 of them, and it never checked the length of an individual parameter. The exploit sends a 140th parameter that is too large. Copying it overruns the buffer and overwrites the program’s own count of how many parameters it has stored. The next parameter then lands outside the buffer, where the attacker uses it to replace the address of a function the program is about to call. The substituted call runs a command of the attacker’s choosing.

Patch 2, the 2.90 firmware named in Zyxel’s June 16 advisory for CVE-2026-7273, added a check on that parameter count. The check runs only after the oversized parameter has been copied, so it reads the value the attacker already wrote and passes. Binarly reports the exploit works against Patch 2 unchanged, and the exploit’s own list of supported targets includes the Patch 2 build for the GS1900-24. Zyxel told the researchers it considers CVE-2026-7273 to be the missing count check and treats the missing length check as a separate flaw, now CVE-2026-107441. The 2.90 Patch 3 firmware, posted October 23 and announced this week, checks the count before copying a parameter and caps the copy size. Binarly rates CVE-2026-107441 at 9.8 on CVSS against the 8.8 in Zyxel’s entry, and where the vendor describes a “LAN-based, unauthenticated attacker,” the researchers say an attacker “only needs network reachability to the management service.”

Patch 2 and earlier are exploitable across all ten affected models, and the only fix is the Patch 3 build for each one. Zyxel lists no workaround for switches that cannot be updated yet. The advisory also does not say whether updating removes a foothold an attacker already has, or what to check on a switch that may have been compromised. If the management interface was ever reachable from an untrusted segment, those are the questions that matter, and the vendor leaves them open.

The attack data shows what that access buys. GreyNoise reported on September 21 that attackers pulled data off 996 GS1900 switches around August 17 and tied the activity to CVE-2026-7273. The attackers dropped a collection script that gathered switch configurations, hashed root credentials, and network information, then left the output to be retrieved. Of the 996 switches, 564 were still on factory-default credentials, so for most of them the root hashes added nothing the attacker did not already have. GreyNoise attributes the campaign to a group Acronis tracks as Red Heron, describes as Chinese-speaking, and previously linked to a backdoor called JITTERLY in a campaign against Gitea servers. Binarly found the exploit on September 17 in an open directory on a server that was also running a JITTERLY command channel.

Whether the attacked switches already carried Patch 2 is unknown. Neither GreyNoise nor Binarly says, and Zyxel’s advisory does not say whether CVE-2026-107441 has been exploited. Binarly gives two readings: Patch 2 was a botched fix for CVE-2026-7273, or the August attacks used a flaw different from the one CISA listed. CISA added CVE-2026-7273 to its KEV catalog on September 21 and gave federal agencies until September 24 to apply Patch 2. As of its most recent update, the catalog does not list CVE-2026-107441.

Binarly reported the flaw on September 29 and says it will publish a trimmed proof-of-concept soon. Switches reachable from anything you do not control should be on Patch 3 before it does.