Security Flaw Persists in Zyxel Switches Despite June Patch, Exposing Hundreds to Ongoing Exploitation

A critical security vulnerability identified in Zyxel GS1900 series switches has revealed a troubling lapse in the vendor’s previous remediation efforts. Research published on November 3 by firmware security firm Binarly has confirmed that a significant flaw in the switch firmware survived a June security update, casting doubt on the efficacy of that patch and raising serious questions about the security posture of nearly 1,000 devices worldwide that were believed to have been secured earlier this year.

The discovery, which centers on an out-of-bounds write vulnerability now designated as CVE-2026-107441, is linked to a series of sophisticated attacks that threat intelligence firm GreyNoise first brought to light in September. These attacks have targeted 996 Zyxel GS1900 switches across 48 countries, resulting in the unauthorized extraction of sensitive system configurations, hashed root credentials, and critical networking information. The persistence of this flaw suggests that while Zyxel attempted to mitigate the threat earlier this year, the underlying vulnerability remained accessible to attackers, potentially leaving these organizations vulnerable for months.

The Failure of the June Remediation

The origin of the current security crisis can be traced back to June 16, when Zyxel released a patch for CVE-2026-7273. At the time, this vulnerability was characterized as a stack-based buffer overflow within the switch’s web management program, carrying a CVSS score of 8.8. Given the nature of the exploit, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) promptly added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on September 21—the same day GreyNoise reported that attackers were actively weaponizing the vulnerability to compromise Zyxel infrastructure.

However, the analysis conducted by Binarly paints a more complex picture. By reverse-engineering an obfuscated Python exploit that matched the malicious activity described by GreyNoise, the researchers concluded that the June "fix" failed to actually address the root cause of the vulnerability. When Binarly scrutinized the ten firmware releases issued in June, they discovered that the vulnerable code remained entirely intact.

According to the researchers, while the June update did introduce a security check, it was fundamentally flawed in its implementation: the validation process was designed to execute only after the unsafe memory copy had already taken place. Consequently, the patch was functionally inert against the specific exploit being used in the wild. Binarly noted that there are essentially two potential explanations for this failure: either the original documentation and CVSS scoring for the June patch were fundamentally inaccurate, or the attacks themselves were leveraging an entirely different, previously unknown flaw, which would render CISA’s initial identification of the threat as CVE-2026-7273 incorrect. In either scenario, the end result for the user base was the same—all ten firmware versions advertised as comprehensive fixes continued to expose the devices to the same risk.

Disputed Severity and the Path to Resolution

The disagreement between Zyxel and the research community extends beyond the efficacy of the patch to the very nature of the risk posed by CVE-2026-107441. Zyxel maintains that the vulnerability, which allows an unauthenticated attacker to execute operating system commands with root privileges, carries a severity rating of 8.8. Furthermore, the vendor has suggested that exploitation typically requires the attacker to be positioned on the local network.

Conversely, Binarly has assigned a higher CVSS score of 9.8 to the flaw, arguing that the threat is more severe because it does not strictly require local network access. Instead, the researchers contend that exploitation is possible for anyone with network access to the switch’s web-based management service. This discrepancy in risk assessment highlights the ongoing tension between vendors and independent security researchers regarding the accessibility and impact of hardware-level vulnerabilities.

The chain of events following the discovery of this persistence began on September 29, when Binarly formally notified Zyxel of their findings. Zyxel subsequently confirmed the existence of the flaw on October 11, leading to the development and release of a new, verified patch on October 22. The formal security advisory was eventually published on November 3.

The scope of this vulnerability affects ten distinct models within the GS1900 product line. For example, in the case of the GS1900-8, firmware versions 2.90(AAHH.2)C0 and all prior iterations are considered compromised. Users are required to upgrade to version 2.90(AAHH.3)C0 to fully remediate the risk. Zyxel has issued a directive urging all affected users to apply the latest firmware updates immediately to ensure "optimal protection." Crucially, the vendor’s latest advisory explicitly includes the June releases in its list of affected versions, confirming that any organization that believed it had secured its infrastructure during the summer cycle is, in fact, still operating a vulnerable device.

Broader Implications for Network Infrastructure

The situation involving the Zyxel GS1900 switches serves as a stark reminder of the complexities inherent in securing legacy and embedded network hardware. When patches fail to address the underlying mechanics of a vulnerability, it creates a false sense of security that can be more dangerous than an unpatched state, as administrators may deprioritize the device in their vulnerability management workflows.

The fact that these switches were being used to steal configuration files and credentials suggests that the attackers were not merely interested in disrupting service, but were likely conducting reconnaissance or preparing for deeper, lateral movement within the networks of the affected 48 countries. Such data is often harvested to facilitate long-term persistence, enabling attackers to maintain access even if basic security measures like password changes are implemented.

As the cybersecurity community continues to analyze the nuances of the Zyxel firmware, the incident underscores the critical importance of rigorous, independent validation of security patches. While vendors like Zyxel are responsible for the initial development and distribution of fixes, the role of external research firms like Binarly in verifying the integrity of those fixes has become increasingly vital.

For IT and security administrators, the lesson is clear: the presence of a "patched" status in a software version is not a guarantee of security. Continuous monitoring of security advisories, particularly those involving devices with remote management interfaces exposed to the network, remains a cornerstone of enterprise defense. With CISA maintaining a close watch on the exploitation of network device zero-days and related vulnerabilities, the pressure on manufacturers to deliver accurate, effective, and verified patches has never been higher. Users of the GS1900 series are encouraged to audit their firmware versions against the latest November 3 advisory to ensure their networks are not among those still susceptible to this, or related, unauthorized command execution flaws.