Patched Zyxel GS1900 Switches Remain Exploitable (CVE‑2026‑107441)
What It Is — Zyxel’s GS1900 series switches were patched in October 2026 for CVE‑2026‑107441 (an out‑of‑bounds write in the web‑management CGI). Independent testing by Binarly shows that the fix does not remediate the vulnerability that attackers are exploiting in the wild; the exploit still achieves unauthenticated OS‑command execution on all firmware releases that include the earlier June 2026 fix for CVE‑2026‑7273. The attack is LAN‑based, requires only a crafted HTTP request to /cgi-bin/dispatcher.cgi, and has been used by a Chinese‑speaking threat actor to steal switch configurations, network topology data, and hashed root credentials from roughly 1,000 devices in 48 countries. The exploit script is publicly available (Python 3.10, obfuscated with PyArmor).
Affected Products — Zyxel GS1900 series switches (firmware 2.90(XXXX.1)C0 and earlier; all releases that include the June 2026 patch).
Why It Matters for Trust & Control Assurance — This incident tests the Vulnerability Management and Patch Assurance control objective: merely applying a vendor‑issued patch is insufficient unless you can verify that the patch actually mitigates the specific flaw being exploited.
Recommended Actions —
- Inventory all Zyxel GS1900 devices and record the exact firmware version.
- Validate that the installed firmware patches CVE‑2026‑107441 by running an independent exploit test or using a trusted verification service.
- If vulnerable, upgrade immediately to the latest Zyxel firmware that addresses CVE‑2026‑107441 (or apply a temporary network‑segmentation mitigation).
- Incorporate continuous verification of patch effectiveness into your vulnerability‑management workflow and retain evidence for audit purposes.
Source: Help Net Security