Hackers Exploit Zyxel GS1900 Zero-Day Vulnerability to Compromise Nearly 1,000 Network Switches

Attackers used a pre-authentication remote code execution exploit against Zyxel GS1900 switches. They compromised nearly 1,000 devices before Zyxel patched the flaw. Binarly researchers found that the exploit abused a previously unknown bug, not the one Zyxel fixed in June.

GreyNoise reported that around August 17, an actor exploited 996 GS1900 switches across 48 countries. The attacker stole configurations, hashed root credentials, and networking information. GreyNoise attributed the activity to CVE-2026-7273. CISA later added CVE to its Known Exploited Vulnerabilities catalog, as covered here.

Zyxel GS1900 Zero-Day Flaw

Binarly obtained the captured exploit, gs1900_bundle.tar.gz. It contains exp.py, protected with the PyArmor obfuscator, plus a pytransform runtime library and compiled bytecode. The script runs under Python 3.10 and exposes a command-line interface.

The exploit targets /cgi-bin/dispatcher.cgi on MIPS-based GS1900 switches. It has two modes:

• GOT mode: a deterministic Global Offset Table overwrite that needs one request.
• Stack mode: an ASLR brute-force that averages about 2,048 attempts.

The operator must supply the libc base address, the reqParameters address, the strcmp GOT entry, and the offset of system(). The script bars &, =, newlines, and null bytes in commands. Its examples include launching a telnet shell through BusyBox.

Binarly’s advisory BRLY-2026-057 explains the root cause. The CGI parser stores request parameters in a global reqParameters object with 140 entries of 1,024 bytes each. A counter, g_count, follows those entries. The code copies data before checking the count, so an oversized value can corrupt the counter. A negative counter then lets the attacker write memory before the buffer and hijack function pointers.

Zyxel’s June fix added a count check, but the unsafe copy still ran first. Binarly confirmed on September 28 that all ten fixed .2 firmware releases remained exploitable. Zyxel confirmed the new flaw on October 11 and shipped fixes on October 22. It published advisory CVE-2026-107441 on November 3.

Binarly rates the flaw 9.8 (Critical). It describes a remote attacker gaining root command execution, while Zyxel describes a LAN-based attacker. The affected builds are ten GS1900 models on 2.90(…​.2)C0 and earlier, and the fix is 2.90(…​.3)C0.

The same vulnerable parser also exists in httprestorecfg.cgi and httpupload.cgi. GreyNoise reported the victim count under CVE-2026-7273, so it is unclear how many of the 996 switches fell to the newer bug.

Zyxel’s patched releases appear in its community firmware notes. Administrators should upgrade every GS1900 switch to release .3. They should also remove web management interfaces from the internet, limit them to dedicated admin networks, and replace default credentials. Any exposed switch needs a review of configuration changes and a rotation of privileged credentials.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.