Zyxel's June patch did not stop the attack it was credited with fixing

A closed ticket is not a closed door

Patching feels like a closed loop. An advisory names a flaw, the vendor ships an update, an administrator installs it, and the ticket is closed. The Zyxel GS1900 case shows where that loop can break. The ticket can be closed against the wrong flaw.

The lesson here is that patch status records a promise about one named bug. It does not test whether the device can still be attacked.

What Binarly found

Binarly's researchers were studying malware tied to a Gitea campaign that Acronis had reported. On the attackers' server they found an exploit for Zyxel GS1900 switches. The exploit even carried settings for firmware that Zyxel had already patched.

Zyxel had released updates for CVE-2026-7273 on June 16, 2026. According to BleepingComputer's account of GreyNoise's findings, a suspected Chinese-speaking actor called Kapibala began exploiting the switches around August 17. GreyNoise reported 996 compromised devices across 48 countries. BleepingComputer adds that after the attackers gained remote command access, they pulled down a script. It gathered each switch's settings, the scrambled form of the root password, and details about the surrounding network.

On September 21, GreyNoise tied the attacks to CVE-2026-7273. CISA added that CVE to its Known Exploited Vulnerabilities catalog the same day. Binarly then showed the exploit worked on all ten firmware releases that were supposed to fix it. Zyxel confirmed a separate flaw, CVE-2026-107441, and released new firmware on October 22.

How the flaw works

The switch's web server runs a program, dispatcher.cgi, that handles form submissions. It splits each request at every "&" and copies each piece into a fixed table. Binarly says the table holds 0x23000 bytes, in slots of 1,024 bytes. That is 140 slots.

Two checks were missing. The code did not check how long each piece was, and it did not check how many pieces arrived. A counter that tracks the pieces sits right next to the table in memory.

Picture a cabinet with 140 drawers and the clerk's tally sheet taped to its back. Overfill the last drawer and you rewrite the tally. The clerk then files the next document wherever the new tally points.

Binarly's exploit did exactly that. An oversized 140th field overwrote the counter. The next field was then written to a spot before the table. In one mode, the exploit replaced the address of strcmp, a routine that compares text, with the address of system, which runs commands. The first field held the command. No login was needed.

Why the June patch missed it

Binarly's analysis of the June update found that it swapped sprintf for snprintf in places and added checks to the parsing routine. The counter was already corrupted before those checks ran. The checks therefore did not stop the exploit.

The description of CVE-2026-7273 also differs from what the exploit does. It names a stack-based overflow. The exploit writes through a global buffer. Zyxel told Binarly that CVE-2026-7273 concerned missing counter validation, despite the website wording. Zyxel treats Binarly's find as a separate flaw because it also involves the missing size check.

BleepingComputer notes that it is unclear whether the attackers built the exploit to bypass the June update. Binarly says it believes the exploit was generated by an LLM, a large language model. The text reviewed gives no evidence for that belief.

Who carries the risk

Administrators who installed the June update were left exposed while believing they were covered. CISA's Known Exploited Vulnerabilities alert pointed them to that same CVE. Binarly writes that the CISA alert had no effect on protecting devices from this actor, because the actor used a different flaw.

CISA's deadlines under BOD 22-01 bind federal agencies. This case shows a wider limit: a catalog entry tells you which CVE to patch, not whether your device resists the exploit.

What to ask and do

Install the October 22 firmware on GS1900 switches and read Zyxel's November 3 advisory for CVE-2026-107441. Binarly says the fix caps each field at 511 bytes and checks the field count first.

Treat any switch that ran earlier firmware with its web interface reachable as possibly exposed. Review its configuration and rotate its credentials. Keep the management interface off untrusted networks.

Then put three questions to your vendors and your own team:

Does the fix address the bug class, or only the description? Was it tested against the working exploit? Who rechecks a fix after it ships?

A patch is a vendor's claim about one bug. Only testing shows whether the door is shut.

Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Binarly.