---
title: Zyxel GS1900 switches: the fix for KEV-listed CVE-2026-7273 didn't stop the in-the-wild exploit. Binarly says it targets a separate pre-auth RCE, now CVE-2026-107441, fixed in 2.90(…3)C0 | ctxsec
url: https://ctxsec.com/items/zyxel-gs1900-cve-2026-107441-kev-7273-patch-did-not-stop-exploit
description: "CISA added Zyxel GS1900 bug CVE-2026-7273 to KEV on Sep 21 after GreyNoise reported exploitation. Binarly found the actual exploit (gs1900_bundle.tar.gz, an obfuscated 'Zyxel GS1900 Pre-Auth RCE' tool) on infrastructure of the actor behind the JITTERLY backdoor and SIXZUT rootkit, and confirmed that all ten firmware releases Zyxel shipped as the 7273 fix were still exploitable. Zyxel confirmed a new out-of-bounds write in the CGI program, CVE-2026-107441 (Binarly rates it CVSS 9.8), released fixed firmware on Oct 22 and published its advisory today. An unauthenticated attacker who can reach the web interface can run OS commands as root."
status: "official (Zyxel advisory for CVE-2026-107441, Nov 3; Binarly advisory BRLY-2026-057 and research, Nov 3). Zyxel's advisory does not itself mention exploitation; the in-the-wild link comes from Binarly"
published: 2026-11-03
---

> CISA added Zyxel GS1900 bug CVE-2026-7273 to KEV on Sep 21 after GreyNoise reported exploitation. Binarly found the actual exploit (gs1900_bundle.tar.gz, an obfuscated 'Zyxel GS1900 Pre-Auth RCE' tool) on infrastructure of the actor behind the JITTERLY backdoor and SIXZUT rootkit, and confirmed that all ten firmware releases Zyxel shipped as the 7273 fix were still exploitable. Zyxel confirmed a new out-of-bounds write in the CGI program, CVE-2026-107441 (Binarly rates it CVSS 9.8), released fixed firmware on Oct 22 and published its advisory today. An unauthenticated attacker who can reach the web interface can run OS commands as root.

[← Cybersecurity News](/news) · [markdown](/items/zyxel-gs1900-cve-2026-107441-kev-7273-patch-did-not-stop-exploit.md)

official (Zyxel advisory for CVE-2026-107441, Nov 3; Binarly advisory BRLY-2026-057 and research, Nov 3). Zyxel's advisory does not itself mention exploitation; the in-the-wild link comes from Binarly

2026-11-03

### Zyxel GS1900 switches: the fix for KEV-listed CVE-2026-7273 didn't stop the in-the-wild exploit. Binarly says it targets a separate pre-auth RCE, now CVE-2026-107441, fixed in 2.90(…3)C0

- **Affected (Zyxel):** GS1900-8, -8HP, -10HP, -16, -24, -24E, -24EP, -24HPv2, -48 and -48HPv2 running 2.90(…2)C0 and earlier.
- **Fixed (Zyxel):** the matching 2.90(…3)C0 build for each model, e.g. GS1900-24 2.90(AAHL.3)C0, GS1900-48HPv2 2.90(ABTQ.3)C0. Zyxel describes the attacker as LAN-based; in practice that means anyone who can reach the management web UI.
- **Why the first patch failed (Binarly):** the exploit works against the 2.90(…2)C0 releases advertised as fixing CVE-2026-7273. Binarly says either Zyxel's 7273 patch didn't cover the exploited flaw or CISA tied the GreyNoise activity to the wrong CVE. Either way, devices patched only for 7273 stayed exposed from June until the Oct 22 firmware.
- **Timeline:** 7273 fix Jun 16; GreyNoise exploitation report and KEV listing Sep 21; Binarly notifies Zyxel Sep 29; CVE-2026-107441 reserved Oct 11; fix Oct 22; advisory and disclosure Nov 3.

**What to do:** install the 2.90(…3)C0 firmware, don't treat a device as safe just because it has the 7273 update, and keep switch management interfaces on a dedicated management VLAN. If a switch's web UI was reachable from user or guest networks, check it for unexpected telnetd listeners or processes (see the companion hunt).

Sources: [Zyxel: Security advisory for out-of-bounds write vulnerability in GS1900 series switches (CVE-2026-107441, Nov 3)](https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026) · [Binarly advisory BRLY-2026-057](https://www.binarly.io/advisories/brly-2026-057) · [Binarly: Zyxel GS1900 pre-auth RCE exploited in the wild as a zero-day](https://www.binarly.io/blog/zyxel-gs1900-rce-cve-2026-107441) · [CISA KEV catalog (CVE-2026-7273, added Sep 21)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)