Summary
- Researchers found that exploitation remained possible after the June fix for CVE-2026-7273.
- The recovered exploit targets a separate flaw, CVE-2026-107441, in the GS1900 management interface.
- Zyxel has issued new firmware, while NHS England warns that further exploitation is likely.
A vulnerability in Zyxel GS1900 network switches remained exploitable after an earlier security update, according to research that has prompted a new vulnerability disclosure and warnings about continued attacks against affected equipment.
Researchers at Binarly recovered an exploit associated with malicious activity against the switches and found that it continued to work against firmware previously updated to address a different vulnerability.
The newly identified flaw, CVE-2026-107441, affects the web management component of ten GS1900 switch models. Under the conditions described by Zyxel, an unauthenticated attacker with local network access could exploit the weakness to execute operating system commands.
Zyxel released corrected firmware on 22 October and published its security advisory on 3 November. NHS England subsequently warned that attackers had possessed a working exploit before the flaw became publicly known.
Earlier firmware remained vulnerable
In June, Zyxel released firmware addressing CVE-2026-7273, a buffer overflow vulnerability affecting the GS1900 management interface.
That earlier flaw was subsequently associated with attacks against network switches. Threat intelligence company GreyNoise reported activity involving 996 devices across 48 countries, including the theft of configuration information and hashed administrative credentials.
The US Cybersecurity and Infrastructure Security Agency added CVE-2026-7273 to its Known Exploited Vulnerabilities catalogue in September.
However, Binarly’s subsequent investigation challenged the understanding of which vulnerability the attackers had actually exploited.
After recovering an exploit from attacker-controlled infrastructure, the researchers tested it against the firmware releases intended to correct the June vulnerability.
The exploit remained effective against all ten tested firmware variants, demonstrating that the earlier updates did not address the code weakness used by the recovered attack.
Further analysis identified a separate out-of-bounds write vulnerability in the switch management software, subsequently assigned CVE-2026-107441.
The distinction matters because an organisation that installed the June update could reasonably have considered its switches protected against the previously disclosed weakness. The recovered exploit demonstrated that those installations remained vulnerable to a related attack path.
Binarly reported its findings to Zyxel on 29 September. The manufacturer confirmed the newly identified flaw and prepared a further firmware update.
Although the recovered exploit is associated with the wider campaign, the available evidence does not establish that every one of the 996 previously reported compromised switches was attacked through CVE-2026-107441.
Disagreement over the attack’s reach
Zyxel assigns the new vulnerability a CVSS 3.1 score of 8.8 and describes exploitation as requiring access to the affected switch’s local area network.
Binarly has assessed the vulnerability more severely, assigning a score of 9.8 and arguing that the relevant requirement is network reachability to the management service rather than the narrower adjacency condition described by the vendor.
That disagreement affects how organisations interpret exposure. A management interface restricted to a protected administrative network presents different opportunities from one reachable through broader internal or external connections.
Both assessments agree that the weakness permits unauthenticated command execution under the relevant network-access conditions.
The vulnerability also demonstrates how security patching can fail to close an attack route when the underlying software contains more than one related defect. Correcting a previously identified issue does not necessarily eliminate every means of exploiting the affected component.
Network switches create particular concerns because they occupy privileged positions within enterprise infrastructure and may support traffic between sensitive systems, administrative platforms, and operational equipment.
Compromise can expose configuration information, credentials, and other data needed to understand or manipulate the surrounding network. The consequences depend on the switch’s role, permissions, and access to other systems.
NHS England’s National Cyber Security Operations Centre warned on 5 November that working exploit code had been recovered from attacker-controlled infrastructure and assessed further exploitation as likely.
The new firmware fixes are contained in the 2.90 Patch 3 releases for affected GS1900 models. Installations running 2.90 Patch 2 or earlier remain within the vulnerability scope.
Zyxel’s advisory provides model-specific firmware versions, while its published guidance identifies the affected hardware and recommends installing the available updates.
The case leaves a material distinction between a system recorded as patched for the original vulnerability and one demonstrably protected against the exploit subsequently recovered by researchers.
