According to Binarly, a Zyxel GS1900 patch bypass exists: Zyxel’s June 2026 fix for CVE-2026-7273 does not stop the exploit found on attacker infrastructure. Switches on firmware 2.90(Axxx.2)C0 are still open. Zyxel’s .3 builds fix the separate flaw CVE-2026-107441, so run the .3 build for your model.
Zyxel published the CVE-2026-7273 advisory on 16 June 2026 and called it a stack-based buffer overflow in the CGI program. CISA added it to its Known Exploited Vulnerabilities catalogue on 21 September 2026 with a due date of 24 September. Teams that moved to .2 for that date may think they are covered.
Which GS1900 Firmware Closes the Hole?
Zyxel’s advisory of 3 November 2026 lists ten models. Each is fixed by a build that ends in .3, and Zyxel says products not listed remain unaffected. It patched only models still within their vulnerability support period.
| Model | Affected firmware | Fixed firmware |
|---|---|---|
| GS1900-8 | 2.90(AAHH.2)C0 and earlier | 2.90(AAHH.3)C0 |
| GS1900-8HP | 2.90(AAHI.2)C0 and earlier | 2.90(AAHI.3)C0 |
| GS1900-10HP | 2.90(AAZI.2)C0 and earlier | 2.90(AAZI.3)C0 |
| GS1900-16 | 2.90(AAHJ.2)C0 and earlier | 2.90(AAHJ.3)C0 |
| GS1900-24 | 2.90(AAHL.2)C0 and earlier | 2.90(AAHL.3)C0 |
| GS1900-24E | 2.90(AAHK.2)C0 and earlier | 2.90(AAHK.3)C0 |
| GS1900-24EP | 2.90(ABTO.2)C0 and earlier | 2.90(ABTO.3)C0 |
| GS1900-24HPv2 | 2.90(ABTP.2)C0 and earlier | 2.90(ABTP.3)C0 |
| GS1900-48 | 2.90(AAHN.2)C0 and earlier | 2.90(AAHN.3)C0 |
| GS1900-48HPv2 | 2.90(ABTQ.2)C0 and earlier | 2.90(ABTQ.3)C0 |
How Does the Zyxel GS1900 Patch Bypass Work?
Binarly found the exploit on attacker infrastructure that also held the JITTERLY backdoor and the SIXZUT rootkit. The exploit carries settings for the patched 2.90(AAHL.2)C0 build of the GS1900-24, and Binarly says it works against that build without changes. On 28 September 2026 Binarly confirmed that all ten .2 releases stayed vulnerable.
Binarly’s analysis points to the way the web server parses the parameters of a POST request. A counter that is not checked in time lets the 141st parameter land in a global buffer, which gives an arbitrary memory write. The .2 patch added counter checks that run too late.
The .3 build checks the counter before each copy and limits every field to 511 bytes, Binarly says. Zyxel told Binarly that CVE-2026-7273 was a parameter-array overflow from missing counter validation. It treats Binarly’s report as a separate flaw because it also covers the missing size check.
Binarly describes the result as unauthenticated remote code execution. The CVE record says an unauthenticated attacker on the adjacent network can potentially run OS commands through a crafted HTTP request, and Zyxel’s score is 8.8 on CVSS 3.1.
What Do Binarly, CISA and NVD Say About Exploitation?
- Exploitation reported by BinarlyYesBinarly says the exploit it found on attacker infrastructure targets this flaw, which it calls a zero-day3 Nov 2026
- Listed in CISA KEVNot seenNot in catalogue 2026.11.04; CVE-2026-7273 was added on 21 Sep 20264 Nov 2026
- NVD statusNot seenAwaiting Analysis; Zyxel’s CVSS 3.1 score of 8.8 is the only score, with no CVSS 4.0 in the record or NVD5 Nov 2026
- Fixed versionYesThe .3 build for each of the ten models in the table3 Nov 2026
What Should You Do Now?
Zyxel names the update. The other steps are our advice, ordered by how much risk each removes.
- Read every firmware versionNote the build on each switch. Anything at .2 or earlier is affected, including switches you patched in June.
- Install the .3 buildUse the build for your model from the table above.
- Close the management planeAllow the switch web interface only from a management network, because the attack comes from the adjacent network.
- Ask about unlisted modelsZyxel lists patches only for models in support. Ask Zyxel about any GS1900 not in the table.
- Check access recordsLook for requests with an unusually high number of parameters in POST requests sent to a switch web interface. This is our reading of Binarly’s analysis, not a Zyxel signature.
Our ranking of the 4 November 2026 patches covers the original Zyxel advisory. The Zyxel vulnerability tracker lists other Zyxel fixes. For the controls behind step 3, see network segmentation, patch management and the technique page on exploiting public-facing applications.