Binarly researchers have disclosed CVE-2026-107441, an actively exploited out-of-bounds write in the web interface of Zyxel GS1900 series switches. The exploit works unchanged on firmware that carries the fix for an earlier flaw, CVE-2026-7273, which means switches considered patched since June remain exposed.
How Binarly Found the Exploit in an Open Directory
Binarly found the flaw while analyzing an exploit left in an open directory on a malware command server. That server is tied to the JITTERLY Linux backdoor and the SIXZUT rootkit, which Acronis TRU has linked to attacks on Gitea. The researchers worked backward from the attacker’s own tooling to identify the vulnerability in the switch firmware.
An unauthenticated attacker on the adjacent network can use the flaw to run operating system commands on the device. The bug is an out-of-bounds write in dispatcher.cgi, the component of the GS1900 web interface that processes requests.
The Fixed Global Buffer in dispatcher.cgi
According to Binarly, dispatcher.cgi copies each request parameter into a fixed global buffer without checking the size or the number of parameters. The earlier patch for CVE-2026-7273 added checks, but Binarly says it added them too late in the process to stop the overflow. As a result, the June fix gave customers false comfort.
Zyxel told Binarly that the earlier CVE covered a missing counter check and that it treats the new problem as a separate flaw. Binarly also said it believes the exploit it found was generated with a large language model, and it plans to publish a minimized proof of concept.
Earlier GS1900 Attacks Set the Backdrop
The new disclosure follows a documented wave of attacks on the same product line. In September, GreyNoise reported the theft of data from 996 GS1900 switches in 48 countries, with the attacks beginning around August 17. Stolen data included device configurations and hashed root credentials. CISA added CVE-2026-7273 to its Known Exploited Vulnerabilities catalog on September 21.
Zyxel Firmware Released October 22
Zyxel released new firmware on October 22 to address CVE-2026-107441. Administrators should install that version. Switches that were updated only to the June release for CVE-2026-7273 do not have protection against the new bug.
Why a Bypassed Patch Matters for Switch Operators
The disclosure shows how a patch can pass a check yet leave the underlying weakness in place. Here, the memory-handling problem in dispatcher.cgi was not fully closed by the first fix, and the exploit Binarly found works unchanged on firmware that carries the new checks. For administrators, a vulnerability scanner that reports the June firmware as fixed for CVE-2026-7273 will not flag exposure to CVE-2026-107441, so version-based reporting can understate risk until the October firmware is installed.
The attack requires the attacker to be on the adjacent network. That limits remote exposure compared with a flaw reachable from the internet, but it does not remove the risk in environments where an attacker can already reach a segment, such as through another compromised host. Switches sit at the center of local networks, and control of one can allow traffic observation and tampering.
The malware link adds weight to the report. The exploit sat in a directory on a server connected to a Linux backdoor and a rootkit, so the code was part of an operator’s toolkit rather than a laboratory demonstration. Binarly’s belief that a language model generated the exploit also fits a broader pattern in which attackers use such tools to produce working code faster.
What Zyxel GS1900 Owners Should Do Next
Owners should install the October 22 firmware and confirm the running version on every GS1900 unit, rather than relying on the earlier patch record. Binarly’s planned release of a minimized proof of concept will make exploitation easier for others once it is public, which shortens the time available to update.
