Binarly reported that a flaw in Zyxel GS1900 switch firmware survived a June security update. The firm published the research on November 3, 2026.
The flaw is tracked as CVE-2026-107441. It is an out-of-bounds write flaw in the switches' web management program. According to the report, it can allow an unauthenticated attacker to run operating system commands with root privileges.
GreyNoise reported on September 21 that an attacker exploited CVE-2026-7273 against 996 Zyxel GS1900 switches in 48 countries. The report said the attacker took switch configurations, hashed root credentials and networking information. Zyxel fixed CVE-2026-7273 on June 16. The US Cybersecurity and Infrastructure Security Agency added it to its Known Exploited Vulnerabilities catalog the same day.
Binarly analyzed an obfuscated Python exploit that matched the one GreyNoise described. On September 28, the researchers confirmed that all 10 firmware releases shipped as the June fix remained vulnerable. Binarly said the June change added a check that ran only after the unsafe copy had already occurred. The researchers wrote that the change "does not address the vulnerability."
Binar