Somebody has been compromising Zyxel GS1900 switches. Around 1,000 of them, taking configuration files and credentials. For weeks the activity was attributed to CVE-2026-7273, which Zyxel patched on 16 June in firmware 2.90 Patch 2.
Binarly has established that the attribution was wrong. The exploit uses CVE-2026-107441, a different flaw, and it still works on firmware that carries the June fix.
Zyxel treats them as two bugs for a reason that is worth understanding: the June patch added a count check, but the unsafe copy still ran before it, and the exploit also abused missing validation of HTTP parameter lengths. So the fix closed one path into the same code and left another open. The remedy is 2.90 Patch 3, across ten models.
What the catalogue actually says
We downloaded the CISA Known Exploited Vulnerabilities catalogue, version 2026.11.06, 1,769 entries, and looked both CVEs up.
| CVE | Listed? | Added | Deadline |
|---|---|---|---|
| CVE-2026-7273, the one that was blamed | yes | 21 September 2026 | 24 September 2026 |
| CVE-2026-107441, the one being used | no | — | — |
Three days. CISA gave federal agencies three days to remediate a vulnerability that was not the one being exploited.
Work through what compliance looked like. An agency sees the entry on 21 September. It has a Binding Operational Directive obligation with a 24 September date on it. It pushes 2.90 Patch 2 to its GS1900 estate inside the window, records the remediation, and closes the item. That agency did everything the catalogue asked, on time, and its switches remained exploitable by the attack the entry was describing.
As of catalogue version 2026.11.06, CVE-2026-107441 is still not listed. There are 13 Zyxel entries in the catalogue altogether and this GS1900 item is the only switch among them.
Two scores, two threat models
The severities do not agree either, and the disagreement is not cosmetic.
Zyxel scores CVE-2026-107441 at 8.8 and says an attacker must be on the local network. Binarly scores it 9.8 and says it is reachable over ordinary HTTP from any network that can reach the switch.
Those are not two opinions about how bad something is. They are two different claims about where the attacker has to stand. If Zyxel is right, this is a lateral movement problem for an intruder who is already inside. If Binarly is right, it is an internet-facing problem for any switch whose management interface is reachable, and managed switches are reachable far more often than their owners intend.
Roughly a thousand compromised devices is a data point, and it points at Binarly.
Why this keeps happening
A catalogue entry is an identifier plus a deadline. It carries no description of the exploit chain, no indicators, and no way to say "the thing being used in the wild may not be the thing this number names". When the first analysis of an intrusion picks a plausible CVE and the catalogue picks it up, the error propagates into every downstream system that consumes the feed, and those systems are built to mark things done.
The failure mode is specific and worth naming: a scanner, a compliance dashboard and an auditor can all agree that an organisation is clean while the attack that prompted the entry still works against it. Nothing in the pipeline is designed to notice that.
This is the second thing we have written this week about an authority pointing at the wrong target, and it will not be the last. The catalogue is a good idea and an enormously useful artefact. It is also treated as an answer when it is an index.
What to do
- Patch to 2.90 Patch 3 on all ten affected models. Patch 2 is not sufficient and the catalogue will not tell you that.
- If you remediated the September entry and closed it, reopen it. Your records say Zyxel is handled.
- Get the management interfaces off any network that does not need them, which resolves the argument about the two scores without waiting for it to be settled.
- Treat the compromised-device population as credential theft, not just device compromise. Configuration files were taken.
What is not established
- Zyxel's own advisory text. It was not opened, so the version strings and the 8.8 reach us through reporting.
- The exact date of the Patch 3 release; sources give 22 and 23 October.
- Whether CISA intends to add CVE-2026-107441, or whether it considers the existing entry sufficient.
- Who is behind the compromises, and whether any of the agencies that met the September deadline were among the thousand.
- Whether Binarly's 9.8 or Zyxel's 8.8 is the better description. We have not tested the device.
