Zyxel Releases GS1900 Patch 3 After Patch 2 Bypass

Zyxel has released 2.90 Patch 3 firmware for 10 GS1900 network switch models after security researchers found that the previous Patch 2 update did not stop an exploit capable of running commands with root privileges. The issue, tracked as CVE-2026-107441, can be exploited by an unauthenticated attacker who can reach a switch’s web management service.

Patch 2 had been issued for CVE-2026-7273, an actively exploited vulnerability. Binarly reported that the same exploit still worked without changes against Patch 2 firmware, because a separate memory-safety flaw remained in the web-request handling code. Zyxel posted the new firmware on October 23 and announced it in an advisory this week.

A second flaw behind the Patch 2 bypass

Binarly describes CVE-2026-107441 as an out-of-bounds write. The affected program stores web-request parameters in a fixed area designed for 140 parameters. Before Patch 2, it did not verify either the size of a parameter or, initially, how many parameters had been stored.

The exploit supplies an oversized 140th parameter, overwriting memory beyond that area and altering the parameter counter. A subsequent parameter can then be written outside the intended memory region, enabling the attacker to replace a function call with one that executes an attacker-controlled command.

Patch 2 added a parameter-count check, but Binarly says that check occurred only after the oversized value had already been copied. The manipulated counter was therefore already in place. In Patch 3, the counter is checked before a parameter is copied and the copy operation is size-limited. Binarly tested the exploit in emulated firmware and on physical hardware, and said the new code corrects the condition.

Models and firmware that require action

All affected GS1900 devices on Patch 2 or earlier require the Patch 3 build designated for their model. The affected range includes the GS1900-8, GS1900-8HP, GS1900-10HP, GS1900-16, GS1900-24, GS1900-24E, GS1900-24EP, GS1900-24HPv2, GS1900-48 and GS1900-48HPv2.

• GS1900-8 moves from 2.90(AAHH.2)C0 or earlier to 2.90(AAHH.3)C0.
• GS1900-24 moves from 2.90(AAHL.2)C0 or earlier to 2.90(AAHL.3)C0.
• GS1900-24EP moves from 2.90(ABTO.2)C0 or earlier to 2.90(ABTO.3)C0.
• GS1900-48HPv2 moves from 2.90(ABTQ.2)C0 or earlier to 2.90(ABTQ.3)C0.

The remaining models have corresponding model-specific Patch 3 builds in Zyxel’s advisory and firmware release notes. Zyxel lists no workaround for organisations unable to update and does not state whether an upgrade removes access already obtained by an attacker.

Known attack activity raises the urgency

GreyNoise reported on September 21 that attackers had collected data from 996 GS1900 switches around August 17. The collected material included switch configurations, hashed root credentials and network information. Of those devices, 564 still had factory-default credentials. GreyNoise associated the activity with CVE-2026-7273, while Binarly said the described exploit matched the one it analysed.

The U.S. Cybersecurity and Infrastructure Security Agency added CVE-2026-7273 to its Known Exploited Vulnerabilities catalog on September 21 and directed federal agencies to apply the then-available Patch 2 by September 24. Binarly rates the newly tracked flaw at 9.8 out of 10 under CVSS, while Zyxel’s CVE entry rates it 8.8. CISA’s KEV data did not list CVE-2026-107441 at the time of the report.

Businesses using GS1900 switches should inventory deployed models and firmware, apply the matching Patch 3 build, replace factory-default credentials, restrict management-service reachability, and review potentially exposed devices for signs of unauthorised access.