Zyxel Switch Fix Missed the Flaw Behind Attacks on 996 Devices, Researchers Say

Researchers at Binarly have found that a security update Zyxel released in June for its GS1900 switches did not remove the flaw attackers were using. The flaw is an out-of-bounds write in the switches' web management program. It can let an unauthenticated attacker run operating system commands with root privileges. It now has a new identifier, CVE-2026-107441.

The attacks were first tied to CVE-2026-7273, which Zyxel fixed on June 16. On September 21, GreyNoise reported that an attacker had hit 996 GS1900 switches in 48 countries, taking switch configurations, hashed root credentials and networking information. The US Cybersecurity and Infrastructure Security Agency added CVE-2026-7273 to its Known Exploited Vulnerabilities catalog the same day. Binarly analysed an exploit matching GreyNoise's description and confirmed on September 28 that all 10 firmware releases shipped as the June fix remained vulnerable. It said the June change added a check, but only after the unsafe copy had already happened.

Zyxel confirmed the flaw on October 11, released a fix on October 22 and published its advisory on November 3. The vendor rates the flaw 8.8 and says the attacker must be on the local network. Binarly rates it 9.8 and says network access to the management service is enough.