Zyxel GS1900 Patch Bypass Exposes Switches to RCE

Network infrastructure edge security faced another severe test when independent security researchers discovered that Zyxel’s initial software mitigation for a critical vulnerability remained fully exploitable. The flaw, affecting the widely deployed Zyxel GS1900 series of managed switches, exposes embedded web management services to unauthenticated remote code execution. Firmware 2.90 Patch 2, released in June 2026 to resolve CVE-2026-7273, relied on a flawed validation sequence that allowed active zero-day exploits to bypass the intended security boundary.

Following coordinated disclosure by Binarly researchers on 29 September 2026, Zyxel issued firmware 2.90 Patch 3 on 23 October 2026, designating the bypass vector as CVE-2026-107441. This incident underscores the systemic risks inherent in embedded network equipment, where administrative interfaces exposed to untrusted networks combine with subtle memory corruption vulnerabilities. With threat intelligence reporting active exploitation campaigns by groups such as Red Heron, network engineering and security operations teams must immediately audit their edge switch inventory and apply the updated firmware.

Zyxel GS1900 Patch Bypass Summary and Perimeter Risk

The discovery of CVE-2026-107441 highlights a critical vulnerability in the software patch lifecycle for embedded systems. When Zyxel released firmware 2.90 Patch 2 on 16 June 2026, it was intended to neutralise CVE-2026-7273—an unauthenticated out-of-bounds write flaw in the switch web management daemon. However, Binarly analysts determined that the Patch 2 build introduced an incomplete control flow check that attackers could subvert. This resulted in the assignment of a new identifier, CVE-2026-107441, when Patch 3 was published on 23 October 2026.

Severity scoring disparities reflect differing threat models between the vendor and the research community. While Zyxel’s advisory CVE entry rates the vulnerability at 8.8 on the Common Vulnerability Scoring System (CVSS), Binarly rates the flaw at 9.8 (Critical). The higher rating accounts for the unauthenticated network vector and the execution of arbitrary commands with root privileges. According to the research advisory, an attacker requires only network reachability to the web management service, whereas the initial vendor description characterised the attack surface as LAN-based.

Exposing switch management interfaces to wide-area networks or untrusted local segments remains a primary driver of risk. Many organisations treat layer-2 and layer-3 switches as internal infrastructure, omitting them from rigorous vulnerability management programs. When attackers achieve root execution on these devices, they gain visibility into local network traffic, administrative credentials, and VLAN topologies, facilitating lateral movement across the enterprise.

Anatomy of the Exploit: Memory Corruption in Switch Web Management

The underlying vulnerability resides within the binary responsible for parsing Hypertext Transfer Protocol (HTTP) requests in the switch web management interface. The application processes incoming parameter strings and stores them in a statically allocated memory buffer designed to accommodate exactly 140 parameter entries. Prior to the implementation of bounds checking in the security updates, the parameter handling routine lacked size validation for individual parameter entries and failed to verify the total count of incoming parameters.

Attackers exploit this absence of boundary validation by crafting a malicious HTTP request that delivers an oversized 140th parameter. Because the memory structure lacks guard pages or dynamic bounds checks, the excessive data overflows the allocated buffer. This overflow corrupts adjacent memory structures, specifically targeting the internal parameter counter variable maintained by the parsing daemon.

Once the counter variable is overwritten with an attacker-controlled value, subsequent parameter allocations fall outside the intended memory region. By carefully orchestrating the payload layout, the attacker achieves arbitrary memory overwrite capabilities, enabling the redirection of function pointers. When the web server process evaluates these corrupted pointers during routine execution, control flow is hijacked to execute arbitrary shell commands with root privileges.

Why Patch 2 Failed: Deconstructing the Flawed Order of Checks

The failure of firmware 2.90 Patch 2 provides a textbook case study in the importance of validation sequencing during defensive software engineering. Zyxel’s initial attempt to resolve CVE-2026-7273 focused on introducing a boundary check for the parameter counter. However, the implementation suffered from an inversion in the operational sequence.

In Patch 2, the validation logic evaluated the counter variable only after the incoming parameter data had already been copied into the working memory buffer. Because the oversized 140th parameter was processed during the copy operation, it overwrote the counter value *before* the conditional check evaluated it. Consequently, the check validated the corrupted, attacker-supplied value rather than the physical bounds of the buffer, rendering the mitigation ineffective against unmodified exploit payloads.

Binarly’s technical analysis confirmed that existing exploit code functioned against Patch 2 firmware without requiring any modifications. Zyxel subsequently clarified that CVE-2026-7273 specifically addressed the missing counter check, whereas the underlying missing size validation constituted a distinct flaw tracked as CVE-2026-107441. In the corrected Patch 3 codebase, the engineering team restructured the execution flow: the parameter counter is evaluated *before* any data is copied, and individual parameter lengths are explicitly bounded against buffer limits.

Threat Intelligence: Red Heron Operations and In-the-Wild Exploitation

Real-world exploitation of the GS1900 vulnerability series predates the public disclosure of the patch bypass. On 17 September 2026, Binarly researchers discovered a working exploit script hosted in an open directory on a command-and-control (C2) server. This server was actively managed by threat actors associated with JITTERLY backdoor infrastructure.

GreyNoise telemetry from 17 August 2026 identified active scanning and exploitation campaigns targeting 996 GS1900 switches globally. The attackers deployed data-collection scripts designed to harvest sensitive switch configurations, hashed root credentials, and internal network topology maps. A striking characteristic of the compromised population was weak security posture: 564 of the 996 impacted switches were operating with factory-default administrative credentials.

Whether the switches compromised during the August 2026 campaigns were running Patch 2 or unpatched earlier firmware versions has not been publicly disclosed by telemetry providers or the vendor. However, the presence of automated exploitation scripts highlights the speed with which threat groups operationalise edge vulnerabilities before effective patches reach production environments.

Affected Models and Firmware Mapping Matrix

Ten distinct hardware models within the Zyxel GS1900 product family are affected by CVE-2026-107441. Infrastructure teams must verify that their deployment manifests match the exact firmware release strings required for remediation. Firmware builds ending in Patch 2 (.2)C0 and all preceding versions contain the vulnerability.

Zyxel’s official advisory provides no native configuration workarounds for administrative teams unable to immediately apply Patch 3. Consequently, immediate firmware staging is the only verifiable method to eliminate the attack surface on exposed devices.

Forensic Inspection and Incident Response for Edge Switches

Because the vulnerability grants unauthenticated root command execution, security teams must treat any potentially exposed switch as untrusted until proven otherwise. Standard network switch operating systems (NOS) present unique forensic challenges due to their constrained runtime environments and lack of persistent storage visibility compared to general-purpose Linux servers.

Administrators conducting incident response on GS1900 infrastructure should execute the following diagnostic workflow:

1. Review Management Access Logs: Inspect available HTTP daemon access logs for anomalous parameter lengths, repeated malformed requests, or requests originating from unrecognised internal IP addresses.
2. Audit Local User Accounts: Log into the switch via a secure console connection where available and verify that unauthorized local user accounts or modified cryptographic hashes have not been introduced into the configuration file.
3. Inspect Startup Configurations: Export the running configuration (`startup-config`) and verify that unfamiliar Simple Network Management Protocol (SNMP) communities, syslog forwarders, or backdoor cron-like execution entries do not exist.
4. Assume Credential Compromise: Given that threat actors routinely harvest hashed root credentials during initial exploitation, assume that all administrative passwords and SNMP strings configured on vulnerable devices have been compromised.

It remains unconfirmed whether applying firmware 2.90 Patch 3 automatically removes persistent root backdoors, modified binary files, or unauthorized credential configurations left by prior attackers. Therefore, performing a complete factory reset, verifying the clean baseline image via cryptographic checksums, and rebuilding the configuration from a known-good backup is strongly recommended.

Practical Guidance: Deployment Order and Perimeter Hardening

Mitigating edge switch vulnerabilities requires a combination of immediate patching and strict perimeter defence-in-depth measures. SREs and network engineers should execute the following prioritized remediation plan:

• Isolate Management Planes: Immediately restrict access to the switch web management interface. Ensure management traffic traverses exclusively dedicated, out-of-band management VLANs or encrypted VPN tunnels. Never expose HTTP or HTTPS management interfaces directly to public networks or untrusted user VLANs.
• Deploy Patch 3 Builds: Download the appropriate firmware build matching your specific GS1900 model from Zyxel’s advisory portal. Test the upgrade procedure in a staging environment if required, then roll out firmware 2.90 Patch 3 across all production units.
• Mandatory Credential Rotation: Following the firmware upgrade, immediately rotate all administrative passwords, root access hashes, and SNMP community strings across the entire switch fleet. Eliminate any residual default accounts.
• Verify CISA KEV Compliance: Although CISA initially added CVE-2026-7273 to its Known Exploited Vulnerabilities catalog with a remediation deadline of September 2026, teams must track updates regarding CVE-2026-107441 to ensure compliance with internal risk governance frameworks.

Key Takeaways for Infrastructure and Security Leaders

The Zyxel GS1900 patch bypass incident offers critical lessons for engineering leadership and security architects overseeing embedded infrastructure. Vendor patches cannot be accepted on trust alone; the flawed logic in Patch 2 demonstrates that post-copy validation checks are ineffective against memory corruption primitives. Organisations with mature security programs increasingly rely on independent binary analysis and regression testing before deploying firmware updates to edge devices.

Furthermore, embedded network hardware remains a preferred target for threat actors seeking high-privilege access points with minimal monitoring. Treating switches as mere plumbing rather than critical computing endpoints creates invisible blind spots in enterprise security architectures. By combining rigorous firmware management, strict network segmentation, and proactive credential hygiene, engineering teams can significantly reduce the blast radius of edge device compromises.

Frequently asked questions

Why did Zyxel firmware 2.90 Patch 2 fail to prevent exploitation?

Patch 2 attempted to mitigate CVE-2026-7273 by introducing a boundary check on the parameter counter variable. However, the check executed *after* the oversized parameter had already been copied into memory. Because the attacker-controlled parameter overwrote the counter value during the copy operation, the subsequent validation check evaluated the corrupted variable rather than the actual buffer size, allowing the exploit to succeed.

Is CVE-2026-107441 currently listed on CISA’s Known Exploited Vulnerabilities catalog?

While CISA added the initial identifier CVE-2026-7273 to its Known Exploited Vulnerabilities catalog on 21 September 2026, the subsequent bypass flaw tracked as CVE-2026-107441 was not explicitly listed in the catalog at the time of initial disclosure reporting. Organisations should consult official vendor advisories and monitor CISA updates for formal catalog revisions.

Does upgrading to firmware 2.90 Patch 3 remove existing malware or backdoors from a compromised switch?

Vendor advisories have not explicitly confirmed whether installing Patch 3 automatically purges persistent root backdoors, unauthorized scripts, or modified credential files left by prior attackers. Security teams managing potentially compromised units should assume credential compromise, perform a full device reset, and rebuild configurations from a verified clean baseline.

Which Zyxel GS1900 models require the Patch 3 update?

Ten models require immediate firmware updates to Patch 3: GS1900-8, GS1900-8HP, GS1900-10HP, GS1900-16, GS1900-24, GS1900-24E, GS1900-24EP, GS1900-24HPv2, GS1900-48, and GS1900-48HPv2. Any device running firmware builds ending in Patch 2 (.2)C0 or earlier must be upgraded.