The Switch Was Patched, the Exploit Still Worked: Zyxel GS1900 Owners Need a Second Firmware Update
Researchers found that the exploit used to break into nearly 1,000 Zyxel GS1900 network switches still worked on firmware that carried the June fix. A newer Patch 3 release closes the hole. Here is how the story unfolded and what switch owners should do now.
If you updated your Zyxel GS1900 office switches this summer and crossed them off the list, they need to go back on it. Firmware researchers at Binarly found that the exploit attackers used against these switches kept working on the very firmware that was supposed to stop it, and Zyxel has now shipped a second fix.
Our account draws on reporting from Help Net Security and a more technical breakdown at The Hacker News, both of which cite Binarly’s research and Zyxel’s advisory.
How it unfolded
- June 16: Zyxel publishes a fix for CVE-2026-7273, a pre-login buffer overflow in the web management program of its GS1900 switches. The fixed firmware is 2.90 Patch 2.
- Around August 17: According to threat-monitoring firm GreyNoise, attackers pull data from 996 GS1900 switches in 48 countries, including configurations, hashed root credentials and network details. GreyNoise later reported that 564 of those switches were still using factory-default credentials.
- September 17: Binarly, investigating malware tied to the same Chinese-speaking group, finds a ready-to-run exploit kit for the switches sitting in an open folder on one of the attackers’ servers.
- September 21: GreyNoise goes public and ties the attacks to the June flaw. CISA adds CVE-2026-7273 to its list of actively exploited vulnerabilities the same day.
- September 28–29: Binarly confirms the exploit still gives command execution without a login on all ten firmware builds that contain the June fix, and reports it to Zyxel.
- October 11: Zyxel confirms a separate flaw, now tracked as CVE-2026-107441.
- Late October: Zyxel releases 2.90 Patch 3 firmware for the ten affected models (reports give October 22 or 23).
- November 3: Zyxel publishes its advisory, and Binarly publishes its findings.
Why the first patch fell short
The switch’s web interface stores incoming request parameters in a fixed-size area. Patch 2 added a check on how many parameters had been stored, but the check ran only after an oversized parameter had already been copied in. The exploit uses exactly that gap: an oversized parameter overruns the storage area and overwrites the counter, so by the time the check runs it holds the attacker’s value and does not stop the write. The attacker can then redirect the program to run a command of their choosing with root privileges. Patch 3 checks the count first and limits how much data can be copied.
Zyxel’s CVE entry rates the new flaw 8.8 out of 10 and describes an unauthenticated attacker on the local network; Binarly scores it 9.8. Binarly also says it believes the exploit itself was written with help from an AI model. It remains unclear whether the August victims were running Patch 2, and Zyxel’s advisory lists no workaround and does not say whether updating removes access an attacker may already have.
What to do if you have GS1900 switches
- Find every GS1900 switch on your network and check its firmware. Anything on 2.90 Patch 2 or earlier is exposed.
- Install the 2.90 Patch 3 build for each model from Zyxel’s official release notes.
- Make sure the web management interface is not reachable from the internet or from guest and general-user networks.
- Replace any default or shared admin passwords, since attackers in the August wave collected hashed root credentials.
- Treat any switch that was exposed this summer as possibly compromised: review its configuration for changes, and consider a factory reset and clean reconfiguration if anything looks off.
What this means for your company
Network switches rarely get the attention that laptops and servers do, yet they sit in the middle of everything. This case adds an uncomfortable lesson: a version number that says “patched” is not proof that a device is safe. Keep an inventory of network gear and its firmware, keep management interfaces on a separate admin network, change default passwords on day one, and when a vendor reissues a fix, treat it with the same urgency as the first one.
Not sure what firmware your switches, firewalls and access points are running, or who can reach their admin pages? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
