Patched Zyxel GS1900 switches remained open to in-the-wild exploit (CVE-2026-107441)

Zyxel GS1900 is under active attack through a flaw that lets someone break into it directly, which moves this well past an ordinary disclosure.

The affected service is reachable from the network without authentication.

Zyxel GS1900 may already be doing an ordinary job in your environment while also being reachable from a network an attacker can access.

Active exploitation changes the calculus entirely: this has moved from theoretical risk to a live attack technique.

Zyxel GS1900 series network switches that received a fix for a flaw that was later reported to have been exploited in the wild are still open to an exploit attackers used, Binarly found .

Fixed in firmware versions 2.90(XXXX.2)C0, the vulnerability was added to CISA’s Known Exploited Vulnerabilities catalog on September 21, after GreyNoise reported it being exploited by a Chinese-speaking threat actor to compromise and exfiltrate the configuration, networking information, and hashed root-level credentials from nearly 1,000 devices across 48 countries.

Anyone running Zyxel GS1900 2.90 is exposed, and because this is reachable without authentication, exposure doesn't depend on a user doing anything.

In June 2026, Zyxel published an advisory on CVE-2026-7273 , a stack-based buffer overflow vulnerability in the CGI program of Zyxel’s GS1900 firmware versions 2.90(XXXX.1)C0 and earlier, which could allow a LAN-based, unauthenticated attacker to potentially execute OS commands via a crafted HTTP request.

Its investigation into the malware’s command and control server revealed an open directory hosting a file named gs1900_bundle.tar.gz .

What an attacker actually gains: the advisory describes a real security impact once the vulnerable path is reached.

This is the kind of exposure that gets found fast: no login needed, reachable from anywhere, and attackers scan for exactly this signature within hours of disclosure.

Binarly notified Zyxel of its discovery on September 29, and on October 22 Zyxel pushed out a fix for CVE-2026-107441 , an out-of-bounds write vulnerability in the CGI program of the Zyxel GS1900 series switch firmware that could allow a LAN-based, unauthenticated attacker to potentially execute OS commands via a crafted HTTP request.

This is tracked as CVE-2026-107441 -- use that identifier when checking vendor guidance or scanner results.

The affected versions are 2.90, so that's the range to check against your own deployment.

That’s because the patch fixed a different bug (CVE-2026-7273) from the one (CVE-2026-107441) the exploit actually relies on.

A few days before GreyNoise published the report, Binarly started to investigate malware previously analyzed by Acronis researchers and tied to the same attacker.

It runs from the command line and targets /cgi-bin/dispatcher.cgi , the web management CGI on GS1900 switches.

When Binarly tested the exploit, it found something unexpected: the researchers confirmed that it still achieved unauthenticated command execution on all ten firmware releases that already carried Zyxel’s June fix.

Confirm whether Zyxel GS1900 2.90 is present anywhere in your asset and software inventory.

Treat exposed matches as urgent -- exploitation has already been reported.

Binarly researchers said, and noted that cases such as this highlight the urgency for a more reliable way of checking vulnerabilities in software.