Zyxel GS1900 zero-day beat June's patch: 10 models need the .3 build

Zyxel published an advisory on November 3 for CVE-2026-107441, an out-of-bounds write in the web management CGI of its GS1900 smart managed switches. An unauthenticated attacker on the LAN can use a crafted HTTP request to run operating system commands. Ten supported models are affected, and the fixed firmware is the "Patch 3" release that Zyxel posted to its community forum in late October.

The catch for IT teams is which builds are vulnerable. Zyxel's table lists every build ending in .2 "and earlier" as affected. Those .2 builds are exactly what Zyxel shipped in June to fix CVE-2026-7273, an earlier flaw in the same CGI program, and what CISA told federal agencies to install when it added that CVE to its Known Exploited Vulnerabilities catalog on September 21. A switch that was patched on time for the June advisory is still exposed.

How the June fix was bypassed

GreyNoise reported on September 21 that an attacker, a suspected Chinese speaker that BleepingComputer says is tracked as Kapibala, had used a GS1900 exploit around August 17 to take configurations, hashed root credentials and network details from 996 switches in 48 countries. The top three countries were Italy (133), the US (129) and Taiwan (123). GreyNoise tied the exploit to CVE-2026-7273 and says the attacker is the same as, or related to, the group Acronis calls Red Heron.

Binarly, a firmware security company, had found the exploit itself on the attacker's server on September 17. Its researchers Fernando Mercês and Yegor Vasilenko write that it targets /cgi-bin/dispatcher.cgi and runs unchanged against the June firmware. By corrupting a parameter counter before the new bounds check reads it, the exploit gets past that check. Binarly says it confirmed on September 28 that all ten June builds were still vulnerable, told Zyxel the next day, and Zyxel confirmed a new flaw on October 11. The researchers believe the exploit was written with an LLM. Their verdict on the September KEV listing: because the attacker was using a different bug, it "had no effect on protecting devices" from this actor.

When we read them, the NVD record carried Zyxel's score of 8.8 (High) and was awaiting NVD's own analysis. CISA's November 4 KEV alert added an Apple flaw, not this one.

Which builds close it

Zyxel's release notes also list the GS1900-8HP Rev. B1, which takes the same AAHI.3 build. Zyxel says it patched only models still within their vulnerability support period. It says on-market models missing from the table are unaffected, but an older GS1900 past that period may have no fix.

What IT teams should do

• Inventory every GS1900 and read its firmware string. Anything ending in .2 or lower needs the .3 build, including switches you marked as done in June or September.
• Keep the web management interface off user and guest VLANs. Zyxel describes the attacker as LAN-based, so anyone who can reach the management interface from the local network can try it.
• Change factory default passwords now. GreyNoise found that 564 of the 996 victims, more than half, still had them.
• Treat a switch that ran any firmware before .3 as possibly compromised. The attacker took configurations and hashed root credentials, so change the admin password and any shared secrets stored in the config after updating.
• Search firewall, DNS and proxy logs for the indicators GreyNoise published: any host under 981666.xyz, and the IP addresses 74.48.66.73, 104.225.153.141 and 172.245.247.21. Binarly's post has malware hashes and YARA rules for the same campaign.
• Don't rely on version numbers alone. Binarly's lesson from this case is that advisories and version numbers "cannot be blindly trusted."