Zyxel GS1900 switches: the fix for KEV-listed CVE-2026-7273 didn't stop the in-the-wild exploit. Binarly says it targets a separate pre-auth RCE, now CVE-2026-107441, fixed in 2.90(…3)C0
- Affected (Zyxel): GS1900-8, -8HP, -10HP, -16, -24, -24E, -24EP, -24HPv2, -48 and -48HPv2 running 2.90(…2)C0 and earlier.
- Fixed (Zyxel): the matching 2.90(…3)C0 build for each model, e.g. GS1900-24 2.90(AAHL.3)C0, GS1900-48HPv2 2.90(ABTQ.3)C0. Zyxel describes the attacker as LAN-based; in practice that means anyone who can reach the management web UI.
- Why the first patch failed (Binarly): the exploit works against the 2.90(…2)C0 releases advertised as fixing CVE-2026-7273. Binarly says either Zyxel's 7273 patch didn't cover the exploited flaw or CISA tied the GreyNoise activity to the wrong CVE. Either way, devices patched only for 7273 stayed exposed from June until the Oct 22 firmware.
- Timeline: 7273 fix Jun 16; GreyNoise exploitation report and KEV listing Sep 21; Binarly notifies Zyxel Sep 29; CVE-2026-107441 reserved Oct 11; fix Oct 22; advisory and disclosure Nov 3.
What to do: install the 2.90(…3)C0 firmware, don't treat a device as safe just because it has the 7273 update, and keep switch management interfaces on a dedicated management VLAN. If a switch's web UI was reachable from user or guest networks, check it for unexpected telnetd listeners or processes (see the companion hunt).
Sources: Zyxel: Security advisory for out-of-bounds write vulnerability in GS1900 series switches (CVE-2026-107441, Nov 3) · Binarly advisory BRLY-2026-057 · Binarly: Zyxel GS1900 pre-auth RCE exploited in the wild as a zero-day · CISA KEV catalog (CVE-2026-7273, added Sep 21)