Published on November 5, 2026
Zyxel GS1900 Patch Fails to Block Zero-Day Exploit Allowing Root Command Execution
Severity
High
Detail
Researchers from Binarly have disclosed a critical security issue affecting Zyxel GS1900 series switches, revealing that a previously released security update failed to fully mitigate attacks associated with an actively exploited vulnerability. The newly assigned vulnerability, CVE-2026-107441, allows unauthenticated attackers to execute commands with root privileges on affected devices. The researchers discovered that the same exploit used in earlier attacks against CVE-2026-7273 remains effective against devices running the supposedly fixed firmware version.
The issue impacts ten GS1900 switch models running firmware version 2.90 Patch 2 and earlier. Researchers found a working exploit on infrastructure associated with previous malicious operations and confirmed that the exploit successfully bypasses the protections introduced in the earlier firmware update.
The disclosure follows reports from GreyNoise indicating that attackers compromised approximately 996 vulnerable GS1900 switches and collected sensitive information including device configurations, network intelligence, and hashed root credentials. Researchers believe the activity may be linked to a Chinese-speaking threat cluster tracked as Red Heron, which has previously been associated with the JITTERLY backdoor.
How?
The vulnerability exists within the web management request parser used by affected GS1900 switches. The application stores incoming request parameters within a fixed memory structure capable of holding 140 parameters. However, the parser fails to properly validate parameter lengths before copying them into memory.
An attacker can submit an oversized parameter that exceeds the allocated memory boundary and overwrites an internal parameter counter. Once corrupted, subsequent parameters are written outside the intended memory region, allowing the attacker to modify critical program data and redirect execution flow.
Researchers found that the previous security update for CVE-2026-7273 added a validation check on the parameter counter but performed the validation only after the vulnerable memory copy operation had already occurred. As a result, attackers could still exploit the flaw using the same technique despite the presence of the patch.
Successful exploitation enables unauthenticated attackers to execute arbitrary commands with root privileges through the switch’s web management interface. Researchers confirmed the exploit works against both emulated firmware and physical hardware running the affected firmware versions.
Analysis of previous attacks found threat actors deploying scripts that harvested switch configurations, extracted hashed root credentials, and collected internal network information from compromised devices.
Affected Products
| Product | Affected Firmware |
| GS1900-8 | 2.90(AAHH.2)C0 and earlier |
| GS1900-8HP | 2.90(AAHI.2)C0 and earlier |
| GS1900-10HP | 2.90(AAZI.2)C0 and earlier |
| GS1900-16 | 2.90(AAHJ.2)C0 and earlier |
| GS1900-24 | 2.90(AAHL.2)C0 and earlier |
| GS1900-24E | 2.90(AAHK.2)C0 and earlier |
| GS1900-24EP | 2.90(ABTO.2)C0 and earlier |
| GS1900-24HPv2 | 2.90(ABTP.2)C0 and earlier |
| GS1900-24 | 2.90(AAHL.2)C0 and earlier |
| GS1900-48 | 2.90(AAHN.2)C0 and earlier |
| GS1900-48HPv2 | 2.90(ABTQ.2)C0 and earlier |
Conclusion
The discovery of CVE-2026-107441 highlights the risks posed by incomplete vulnerability fixes on critical network infrastructure. The flaw enables unauthenticated attackers to achieve root-level command execution on vulnerable Zyxel GS1900 switches and appears closely related to previous exploitation activity that affected hundreds of exposed devices.
Given the availability of working exploit code, evidence of real-world attack activity, and the ability to compromise core network infrastructure, organizations should prioritize firmware updates and review exposed devices for signs of unauthorized access. Failure to remediate affected systems may allow attackers to obtain administrative control, extract sensitive network information, and establish persistence within enterprise environments.
Source
https://thehackernews.com/2026/11/zyxel-gs1900-patch-fails-to-block-zero.html