CVE-2026-7273 and CVE-2026-107441, Zyxel GS1900 switches: GreyNoise caught a Red Heron-linked actor exfiltrating configurations and hashed root credentials from 996 switches in 48 countries, and Binarly shows its exploit targets a separate flaw that the June fix leaves open; only the .3C0 builds close it
Zyxel GS1900: Binarly says the exploit GreyNoise caught works on the June-fixed builds; install the .3C0 builds
Defender actions
- Install each Zyxel GS1900 switch's "…(x).3C0" build now (2.90(AAHL.3)C0 on the GS1900-24, for example), including switches already moved to the June "…(x).2C0" build, which Binarly shows still carries the flaw the recovered exploit targets, and audit and rotate any switch still on its factory-default admin credentials: GreyNoise found 564 of 996 exploited switches (57%) had never had theirs changed, which lets the actor re-enter even after the hashed credential set is rotated.
Analysis
CVE-2026-7273 is a stack-based buffer overflow in the CGI program of Zyxel GS1900 series smart-managed switch firmware that Zyxel says lets a LAN-based, unauthenticated attacker execute OS commands through a crafted HTTP request to the web-management interface; Zyxel patched ten models on 2026-06-16, each at its own "…(x).2C0" build (Zyxel PSIRT, 2026-06-16). CISA added it to the Known Exploited Vulnerabilities catalog on 2026-09-21 (CISA, 2026-09-21), the same day GreyNoise published research on a suspected Chinese-speaking actor whose activity since 7 May 2026 GreyNoise ties to one actor and assesses is the same as or related to Red Heron, which Acronis profiled for rapid n-day weaponisation of a Gitea flaw (Acronis Threat Research Unit, 2026-09-13), based on a shared command-and-control domain, malware family and tradecraft (GreyNoise, 2026-09-21).
Binarly, whose researchers found the Python exploit GreyNoise described in an exposed archive on infrastructure that BleepingComputer ties to Red Heron (BleepingComputer, 2026-11-04), shows that it works without change against all ten "…(x).2C0" builds, because it targets a different flaw: the CGI's request-parameter parser copies a parameter without a size check and never checks the parameter counter before writing (Binarly, 2026-11-03). Zyxel treats it as a separate vulnerability, CVE-2026-107441, which it fixed on 2026-10-22 in the "…(x).3C0" builds of all ten models and disclosed on 2026-11-03 (Zyxel PSIRT, 2026-11-03; Binarly, 2026-11-03). Binarly calls it a zero-day exploited in the wild because the recovered exploit matches the one GreyNoise described; Zyxel's two advisories say nothing about exploitation, CISA's catalog of 2026-11-04 lists CVE-2026-7273 and not the new flaw, and BleepingComputer says it is unclear whether the exploit was built to bypass the June fix (Binarly, 2026-11-03; Binarly, 2026-11-03; BleepingComputer, 2026-11-04; CISA KEV, 2026-11-04).
On or about 17 August 2026 the actor used a PyArmor-obfuscated Python tool with a deterministic single-request mode and an ASLR-brute-force mode averaging roughly 2,048 attempts, and exfiltrated configuration data, networking information and hashed root-level credentials from 996 switches in 48 countries, making the switch's on-device shell fetch a TFTP-delivered collector script and stage the harvested data to a file on the switch (GreyNoise, 2026-09-21). "While the credentials were hashed, 564 of the victims had factory default credentials" (GreyNoise, 2026-09-21), so for the majority of victims the unrotated default password alone gave durable re-entry. The same actor ran a WordPress chain against at least 49 organizations in 29 countries that cost one unnamed Western government more than 18,000 database records (GreyNoise, 2026-09-21).
Cited evidence
A stack-based buffer overflow vulnerability in the CGI program of the Zyxel GS1900 series switch firmware could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.
The MCA successfully exploited and exfiltrated sensitive data from 996 ZyXEL switches across 48 countries.
While the credentials were hashed, 564 of the victims had factory default credentials.
The adversary is the same or related to “Red Heron” reported on by Acronis based on use of the same command and control (C2) domain, malware family, exploitation of Gitea in July, and other tactics, techniques, and procedures (TTPs).
The out-of-bounds write vulnerability in the CGI program of the Zyxel GS1900 series switch firmware could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.
so the latest firmware version released as a fix to CVE-2026-7273 is vulnerable to the same exploit, which works without changes.
While the recovered exploit specifically targeted firmware patched for CVE-2026-7273, it remains unclear whether it was deliberately developed to bypass those updates or exploited a related vulnerability that the earlier patches failed to address.
Updates1
Binarly reports that the Python exploit GreyNoise described, which it found in an exposed archive on infrastructure that BleepingComputer ties to Red Heron (BleepingComputer, 2026-11-04), targets a flaw in the request-parameter parser of the switches' CGI (dispatcher.cgi), not the stack overflow of CVE-2026-7273, and that it works without change against the "…(x).2C0" builds Zyxel advertised as the June fix; Binarly confirmed this against all ten builds on 2026-09-28 (Binarly, 2026-11-03). Zyxel treats the report as a separate vulnerability, CVE-2026-107441, fixed on 2026-10-22 in the "…(x).3C0" builds of GS1900-8, -8HP, -10HP, -16, -24, -24E, -24EP, -24HPv2, -48 and -48HPv2 and disclosed in an advisory of 2026-11-03 that credits Binarly and shows no score or exploitation statement (Zyxel PSIRT, 2026-11-03; Binarly, 2026-11-03). Binarly labels the flaw an in-the-wild zero-day on the strength of the exploit match, scores it 9.8 with a network vector against Zyxel's LAN-based wording, and says it will publish a minimised proof of concept; CISA's catalog of 2026-11-04 lists only CVE-2026-7273 (Binarly, 2026-11-03; Binarly, 2026-11-03; BleepingComputer, 2026-11-04; CISA KEV, 2026-11-04). Switches on the June build are therefore still exposed to the exploit until the "…(x).3C0" build is installed.
Sources9
Revision history
- Published 2026-09-22T0410Z-intel
- Update 2026-11-05T0255Z-intel
Binarly shows the exploit GreyNoise described works against all ten June-fixed GS1900 builds because it targets a separate flaw, CVE-2026-107441, which Zyxel fixed in the .3C0 builds on 2026-10-22 and disclosed on 2026-11-03; the .3C0 builds replace the .2C0 builds as the remedy, and exploitation of the new CVE rests on Binarly's exploit match, which neither Zyxel nor CISA confirms.
Changed: title headline summary cves sources evidence sourcing_note actions body classification
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.