Owners of Zyxel GS1900 switches who installed the June security update did the right thing, and it would not have protected them. Researchers at Binarly say the exploit an attacker used against close to 1,000 of these small-business switches targets a separate, previously unknown flaw that the June firmware left open. Zyxel has now fixed it as CVE-2026-107441.
The bug is an out-of-bounds write (code writing past the end of a memory buffer) in the switches' web management program. According to Zyxel's advisory, an unauthenticated attacker can send a crafted HTTP request and potentially execute operating system commands. Zyxel credits Yegor Vasilenko and Fernando Mercês of Binarly with the report.
A patch aimed at the wrong bug
The story starts with a campaign GreyNoise documented in September. GreyNoise reported that one operator exploited 996 GS1900 switches across 48 countries and exfiltrated switch configurations, hashed root credentials and networking information, tying the activity to CVE-2026-7273, a flaw Zyxel had patched on 16 June. CISA added CVE-2026-7273 to its Known Exploited Vulnerabilities catalog on 21 September. We covered that campaign in our report on the same operator's government data theft.
Binarly reached the same exploit from a different direction. While analysing the JITTERLY backdoor and SIXZUT rootkit that Acronis TRU had linked to attacks on Gitea servers, its team found an open directory on one command server holding a file named gs1900_bundle.tar.gz. The exploit inside carried memory addresses for firmware builds up to 2.90(AAHL.2)C0, the very release meant to fix CVE-2026-7273.
That was the tell. Binarly's binary diff showed the June fix checks a parameter counter only after an unbounded copy has already let the attacker overwrite that counter, so the patched firmware is vulnerable to the same exploit, which works without changes. Binarly confirmed on 28 September that all ten fixed releases remained exploitable, notified Zyxel the next day, and Zyxel confirmed a new vulnerability on 11 October.
The consequence is uncomfortable. CISA's alert told owners to upgrade, but because the attacker was exploiting a different flaw, Binarly says the upgrade had no effect against this actor. Binarly also believes the exploit itself was LLM-generated.
8.8 or 9.8, depending on who you ask
Zyxel scores CVE-2026-107441 at 8.8 (High) and treats the attacker as adjacent, on the local network. In its own advisory Binarly disagrees: exploitation uses plain HTTP and needs only network reach to the management service, so it rates the flaw 9.8 (Critical). Zyxel's advisory does not say whether CVE-2026-107441 has been exploited, and CISA's catalog still lists only CVE-2026-7273, so the link between this flaw and the 996 compromises rests on Binarly's analysis of the captured exploit.
Install 2.90 Patch 3, then check the switch
Zyxel shipped fixed firmware on 22 October and published its advisory on 3 November. Ten models are affected, from the GS1900-8 to the GS1900-48HPv2, on 2.90 builds up to and including the .2 release. The fixed builds end in .3, for example 2.90(AAHL.3)C0 for the GS1900-24 and 2.90(AAHK.3)C0 for the GS1900-24E. Zyxel lists no workaround. Because the June update did not stop this exploit and the attacker took hashed root credentials, a switch whose management interface was reachable this summer is worth treating as possibly compromised rather than simply patched.
Infrastructure Binarly tied to the JITTERLY operator includes:
- s2.981666[.]xyz (104.225.153[.]141), JITTERLY C2 on ports 5432, 6379 and 8082
- p2.981666[.]xyz (104.223.65[.]148), JITTERLY C2 and the open directory that hosted the switch exploit
- s7.981666[.]xyz (166.88.227[.]181), JITTERLY C2 on port 443
- SIXZUT rootkit SHA-256: 728810b07e911b235f6450e784391e39f68819a0a5d209662162916ffea25146
Peru's National Digital Security Center flagged the new fix in its integrated digital security alert 219-2026.
The lesson reaches well beyond Zyxel. A firmware version that says "fixed" is a claim, and here only reading the binary showed the claim was wrong.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.