Zyxel GS1900 Patch 2 Still Lets Attackers Get Root

Zyxel GS1900 Patch 2, the June 16, 2026 firmware for CVE-2026-7273, can still be rooted without a login. Binarly says only 2.90 Patch 3 closes CVE-2026-107441. Network reachability to the web management interface is the only precondition.

What happened to the Zyxel GS1900 Patch 2 fix?

Zyxel GS1900 Patch 2 does not stop the exploit attackers were already using. Binarly found GS1900 switches on firmware 2.90 Patch 2, the June fix for CVE-2026-7273, still open to that exploit. Zyxel tracks the hole the exploit uses as CVE-2026-107441. The image that closes it is 2.90 Patch 3.

Zyxel’s advisory, dated June 16, 2026, named CVE-2026-7273 and pointed owners to 2.90 Patch 2. Anyone who installed that build and stopped is still on a vulnerable image, according to Binarly. The lab reported the flaw to Zyxel on September 29, 2026. A working exploit already existed by that report date. Binarly calls CVE-2026-107441 a zero-day at the time of its report to the vendor. The label describes September 29, not the firmware after October 23.

Zyxel posted 2.90 Patch 3 for ten GS1900 models on October 23, 2026, with the firmware release notes. The public advisory followed the week of November 2. The Hacker News reported the gap on November 5, in a piece by Swati Khandelwal.

Get the file from the model row in that Zyxel advisory, posted with the release notes. Owners on Patch 2 or anything older install that model’s Patch 3 image. The advisory does not require a stop on Patch 2 first.

Zyxel does not treat the two CVE IDs as one bug. Binarly says the vendor described CVE-2026-7273 as the missing check on how many web parameters the switch had stored, and the missing size check on each parameter as CVE-2026-107441. That split is Binarly’s account of what Zyxel said. It is not an outside ruling that the code holds two independent defects. Binarly also leaves open whether Patch 2 was a faulty fix or whether the attacks used a different bug.

Binarly rates CVE-2026-107441 at 9.8. Zyxel’s CVE entry lists 8.8. The one-point gap is not a reason to wait. The advisory lists no workaround, and it does not say how an owner should decide whether a switch was already compromised. Installing Patch 3 does not answer whether configurations and credential hashes already left the device. Treat the upgrade and the credential rotation as one job.

Which GS1900 models need firmware 2.90 Patch 3?

Ten GS1900 models need 2.90 Patch 3 if they are on 2.90 Patch 2 or anything older. Binarly says the flaw is present in all ten Patch 2 builds. Match the model, then the image letters, then the patch digit.

Zyxel strings look like 2.90(AAxx.y)C0. The letter group is the model image. The digit after the dot is the patch level. Vulnerable firmware is the .2 string and earlier. Fixed firmware is the matching .3 string.

Copy the full version string the switch reports and compare it with this table. A string that ends in .2)C0 matches Patch 2. A string that ends in .3)C0 matches the October fix. Anything older than Patch 2 is in the affected range as well. It does not say which screen prints them.

Binarly tested the exploit on emulated firmware and on real hardware. The lab did not name the hardware model. The exploit’s own supported-firmware list includes the GS1900-24 Patch 2 build, 2.90(AAHL.2)C0. That shows the GS1900-24 Patch 2 image was an intended target of the exploit binary. It is not a count of which models were hit in August. Binarly says all ten Patch 2 builds contain the flaw.

If the inventory export stores a shortened version, pull the full string before the ticket closes. The patch digit is the decision.

Can a web request get root without a login?

Anyone who can reach the GS1900 web management service can run commands as root without logging in, on firmware through 2.90 Patch 2. Binarly’s line is direct: an attacker only needs network reachability to the management service. Zyxel’s advisory describes a LAN-based, unauthenticated attacker. A management page that answers only from a locked admin VLAN matches the vendor sentence. A page that answers from a wider set of networks matches Binarly’s reachability test.

The root cause is an out-of-bounds write in the program that handles web requests. The handler stores request parameters in a fixed area sized for 140 parameters. It did not check the size of an individual parameter. Before Patch 2 it also never checked how many parameters had been stored.

An oversized 140th parameter runs past the end of the storage area and overwrites the counter that tracks how many parameters are present. The next parameter is then written outside the area. Overwriting the counter lets the attacker replace the function the program is about to call with one that runs attacker-supplied commands. Those commands execute as root.

Patch 2 added a check on the parameter counter. Binarly’s finding is that the check runs only after the oversized parameter has already been copied. Binarly states the exploit works against Patch 2 without changes. Patch 3 moves the counter check to before the copy and limits the size of the copy. On Patch 2, Binarly’s test of the unchanged exploit succeeded.

None of this requires a password on the switch. Factory defaults are not the precondition for CVE-2026-107441. Reachability is. A guest VLAN, a VPN on the same subnet, the public internet, or a forwarded management port is still reachability.

Binarly has said it will publish a reduced proof of concept. No date was given as of the November 5 reporting. A working exploit was already on attacker infrastructure in September.

Were the August attacks against switches already on Patch 2?

Nobody has shown that the August victims were running Patch 2. GreyNoise reported on September 21, 2026 that attackers took data from 996 GS1900 switches around August 17. GreyNoise and Binarly do not state which firmware those switches were running. Zyxel’s advisory does not say whether CVE-2026-107441 has been exploited.

The stolen material included switch configurations, hashed root credentials, and network information. Attackers used the exploit to download a collection script onto the switches and left the collected data to be picked up later. Of the 996 switches, 564 still used factory-default credentials. That is about 57 percent. Defaults did not have to be the way in for the memory bug.

GreyNoise attributes the activity to the same group as, or a group related to, the cluster Acronis tracks as Red Heron, and describes that cluster as Chinese-speaking. The public reporting does not name one actor for every switch. Acronis has linked a backdoor called JITTERLY to Red Heron in an earlier campaign that targeted Gitea servers. Binarly found the GS1900 exploit on September 17 in an open folder on a server that also acted as command-and-control for JITTERLY. That overlap is documented. It is not a firmware version, and it is not an identification of all 996 victims.

Do not flatten that chain into one settled actor who hit both Gitea servers and every GS1900. Configurations and hashed credentials still let an intruder map VLANs and try the same secrets on routers, hypervisors, NAS boxes, and the PCs that store panel, SSH, and database passwords.

The same reachability lesson shows up in MikroTik RouterOS bugs that became a full admin takeover.

CISA added CVE-2026-7273 to the Known Exploited Vulnerabilities catalog on September 21, 2026, the day GreyNoise published. Federal civilian agencies had until September 24 to apply Patch 2. That deadline bound those agencies. It did not bind a private hosting shop. As of the catalog data updated November 4, 2026, CVE-2026-107441 was not listed. Absence from KEV is not evidence a flaw is unused. Agencies that met September 24 by installing Patch 2 met that listing. On Binarly’s analysis they stayed exposed to this exploit until Patch 3.

Binarly offers two readings and does not choose. One: Patch 2 was a faulty fix for CVE-2026-7273, and the attacks used this bug. Two: the attacks exploited a different flaw from the one CISA listed. The confirmed fact is narrower. Patch 2 does not stop this exploit. Whether the 996 August switches were past the June update is not established in the GreyNoise report, the Binarly advisory, or Zyxel’s notice.

What should you do if this switch sits in front of the sites?

Install 2.90 Patch 3 on every in-scope GS1900, then assume the management plane may already have leaked its config and its password hashes. The advisory has no workaround.

1. Record the full firmware string before the upgrade and note whether it matches a .2)C0 row, an older row, or a .3)C0 row in the advisory table.
2. Install the Patch 3 build for that exact model from the Zyxel advisory package posted with the release notes. After reboot, confirm the reported string matches the fixed column, not a shortened 2.90.
3. Move web management off every network that is not a dedicated management VLAN. Guest Wi-Fi, the server VLAN, and a VPN user subnet all count as exposure.
4. Change the admin password. If it is still the factory default, change it first. Then change SNMP communities and any local account you do not recognize.
5. Compare the running config with the last backup you trust. Look for new users, changed management access lists, altered SNMP, unexpected VLAN or port edits, and a management IP with outbound sessions you did not design.
6. Rotate secrets that lived in that config or on admin browsers and jump hosts: panel logins, SSH, SFTP, hypervisor, NAS, and database passwords used from the same office.

Hashes and saved configs are the same class of downstream risk as what a leaked appliance credential means for the site behind it. The August operators staged a collection script and came back for the data. Check the management IP’s history, the config diff, and the account list.

Patch 3 closes CVE-2026-107441. It does not retire the password printed on the device, and it does not shrink who can open the management page. The management UI is often reachable from the same VLAN as the WordPress or Joomla server.

If Patch 3 cannot go on today, keep the management service reachable only from a host you control on the management VLAN, and remove any port forward or tunnel that exposes it. That is containment. Zyxel documented no workaround.

Checks on the website will not see an out-of-bounds write on a GS1900. They can see a webshell, a spam inject, or a checkout script if someone used the switch as a step into the server VLAN. A .3)C0 string closes this flaw on the switch. If stolen configs and hashes already reached the server VLAN, the site can still carry a backdoor. Website protection covers monitoring on the server. It does not flash Zyxel firmware.

FAQ

Is Zyxel GS1900 firmware 2.90 Patch 2 still vulnerable?

Yes. Binarly found that 2.90 Patch 2, the June 16, 2026 fix for CVE-2026-7273, still allows the exploit. The flaw the exploit uses is CVE-2026-107441, closed in 2.90 Patch 3.

What is CVE-2026-107441 on Zyxel GS1900 switches?

It is an out-of-bounds write in the web request handler. An unauthenticated attacker who can reach the management service can run commands as root. Binarly scores it 9.8. Zyxel's CVE entry lists 8.8.

Which GS1900 models need firmware 2.90 Patch 3?

GS1900-8, 8HP, 10HP, 16, 24, 24E, 24EP, 24HPv2, 48, and 48HPv2. Each model has its own image letters. Install that model's 2.90 Patch 3 string if the switch is on Patch 2 or older.

Should I change the GS1900 admin password after updating?

Yes. GreyNoise found factory-default credentials on 564 of 996 switches hit around August 17, and the stolen data included hashed root credentials and configs. Change the admin password, SNMP communities, and any secret that lived in that config.

If the switch is patched and the sites behind it still look wrong, SiteGuarding can clean the web tier and put a firewall in front of it. Start with website protection and keep the GS1900 management page on a VLAN only you can reach.