Zyxel published a security advisory on 3 November 2026 for CVE-2026-107441, an out-of-bounds write vulnerability in the CGI program of GS1900 series switch firmware that could allow a LAN-based, unauthenticated attacker to potentially execute OS commands via a crafted HTTP request. Zyxel lists ten models affected, from 2.90(.2)C0 builds and earlier, with patches in the matching 2.90(.3)C0 builds, and credits Yegor Vasilenko of Binarly for the report.

Zyxel, as the CVE numbering authority, scores it CVSS 3.1 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). (sources: Zyxel; CVE record)

According to BleepingComputer, Zyxel released the firmware updates on 22 October; a suspected Chinese-speaking threat actor that GreyNoise tracks as Kapibala compromised 996 GS1900 devices in 48 countries from around 17 August, attacks GreyNoise had attributed to the older CVE-2026-7273 fixed in June.

BleepingComputer reports that Binarly found an obfuscated exploit in an exposed archive on the attackers' infrastructure that checked for firmware patched for CVE-2026-7273 and confirmed on 28 September that it still worked against all ten patched releases by corrupting a parameter counter before it was validated; Binarly reported this to Zyxel on 29 September and Zyxel confirmed the new flaw on 11 October. (source: BleepingComputer)