Zyxel GS1900 Patch 2 Retains Root RCE via Post-Check OOB Write in Web Handler
Zyxel’s incremental Patch 2 failed to close a root RCE zero-day in GS1900 switches because the length check executes after the attacker-controlled copy. Independent researchers and GreyNoise telemetry show active exploitation predates the second fix, contradicting vendor and CISA timelines.
The flaw resides in the web request processor that allocates a 140-parameter buffer without bounds-checking size or count before Patch 2. Attackers send an oversized 140th parameter that overwrites the counter after the copy operation but before the new length check runs, allowing return-oriented replacement of the next function pointer. GreyNoise observed 996 compromised switches on 17 August, matching the exploit chain later tied to both CVEs.
Zyxel’s June advisory for CVE-2026-7273 and CISA’s 21 September KEV listing treated Patch 2 as sufficient remediation, yet the vendor’s own 23 October release notes confirm the same 2.90(AAxx.2)C0 builds remain vulnerable. Binarly’s September 29 report rates the issue 9.8 CVSS with root execution; the vendor entry lists 8.8 and LAN-only scope, exposing a persistent gap between independent technical analysis and vendor scoping.
This pattern repeats across IoT switch firmware where memory-safety fixes are applied incrementally without re-auditing the request path. Owners of the listed GS1900 models must move directly to Patch 3 builds; no workaround or post-compromise detection guidance exists in current advisories.
CISA has not yet added CVE-2026-107441 to KEV. Procurement records show GS1900 units remain in federal and critical-infrastructure inventories, indicating continued exposure until agencies complete forced upgrades.
Sources (3)
- [1]Primary Source(https://www.binarly.io/advisories/zyxel-gs1900-rce)
- [2]Supporting Source(https://www.greynoise.io/blog/zyxel-gs1900-exploitation)
- [3]Supporting Source(https://www.zyxel.com/support/security-advisories)