{"slug":"zyxel-gs1900-cve-2026-107441","title":"Zyxel GS1900 pre-auth RCE (CVE-2026-107441)","shortName":"GS1900","summary":"Unauthenticated out-of-bounds write in the GS1900 web-management CGI (CVE-2026-107441, Zyxel CNA CVSS 3.1 8.8; Binarly rates 9.8). Zyxel says a LAN-based attacker can run OS commands with one crafted HTTP request. Related CVE-2026-7273 is the June 2026 stack-overflow CVE that CISA listed in KEV on 21 Sep 2026; Binarly (3 Nov 2026) says the in-the-wild exploit targets 107441 and still works on the .2 builds shipped as the 7273 fix. Zyxel's 3 Nov 2026 advisory does not mention exploitation. CVE-2026-107441 is not in CISA KEV (catalog 2026.11.03, checked 4 Nov 2026). Badge: Reported exploited. No public PoC indexed. Fixed in each listed model's 2.90(xxxx.3)C0.","isExample":false,"draft":false,"family":"zyxel-gs1900-cve-2026-107441","kind":"single-product","aliases":["CVE-2026-107441","CVE-2026-7273","BRLY-2026-057","GS1900 pre-auth RCE","Zyxel GS1900"],"publishedAt":"2026-11-04","updatedAt":"2026-11-04","patchStatus":"patched","exploited":"reported","scores":{"cve":"CVE-2026-107441","cvss":{"cve":"CVE-2026-107441","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1","scorer":"cna","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107441","sourceDate":"2026-11-03","checkedDate":"2026-11-04","dateLabel":"CNA published","sourceLabel":"Zyxel CNA (CVSS 3.1 8.8, AV:A). NVD API 4 Nov 2026: Awaiting Analysis, Secondary CNA metric; no NVD-produced Primary. Binarly BRLY-2026-057 rates CVSS 3.1 9.8 (AV:N) separately.","nvdPublishedDate":"2026-11-03"},"epss":{"cve":"CVE-2026-107441","score":0.00293,"percentile":0.21968,"date":"2026-11-03","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-107441","checkedDate":"2026-11-04"},"kev":{"cve":"CVE-2026-107441","listed":false,"dateAdded":null,"dueDate":null,"catalogVersion":"2026.11.03","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","checkedDate":"2026-11-04"},"addedDate":"2026-11-04"},"priority":{"label":"act-now"},"managementSummary":{"what":"Unauthenticated out-of-bounds write on Zyxel GS1900 web CGI (CVE-2026-107441, Zyxel CNA CVSS 3.1 8.8). Binarly rates 9.8 and says the in-the-wild exploit targets this CVE, including on .2 firmware shipped as the CVE-2026-7273 fix. Related CVE-2026-7273 is in CISA KEV (added 21 Sep 2026). CVE-2026-107441 is not in KEV (checked 4 Nov 2026). Zyxel has not stated exploitation. Badge: Reported exploited.","action":"Install the model-specific 2.90(xxxx.3)C0 firmware. Do not treat .2 (7273-fixed) devices as safe. Keep the web UI on a management VLAN. Change default credentials. If a switch's web UI was reachable from untrusted networks while on a .2 or older build, investigate it as possibly compromised."},"seenInTheWild":[{"metric":"third-party-stated","value":"Recovered in-the-wild exploit targets CVE-2026-107441, including 7273-patched .2 firmware","observer":"Binarly","date":"2026-11-03","method":"Binarly blog and BRLY-2026-057 (3 Nov 2026). Researchers recovered a PyArmor-obfuscated exploit from an open directory on a JITTERLY C2 host and say it works without changes on 2.90(AAHL.2)C0. Zyxel has not stated exploitation. First calendar day of 107441 use: not verified.","sourceUrl":"https://www.binarly.io/blog/zyxel-gs1900-rce-cve-2026-107441"},{"metric":"third-party-stated","value":"996 GS1900 switches in 48 countries; configs and hashed root credentials stolen; 564 on default credentials","observer":"GreyNoise","date":"2026-09-21","method":"GreyNoise (Andrew Thompson, Mark Mager, 21 Sep 2026) attributed that activity to CVE-2026-7273, with first use on or about 17 Aug 2026. Binarly later says the recovered exploit targets CVE-2026-107441. These counts stay GreyNoise-attributed to 7273.","sourceUrl":"https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation"},{"metric":"third-party-stated","value":"Related CVE-2026-7273 listed in KEV (due 24 Sep 2026)","observer":"CISA","date":"2026-09-21","method":"Catalog entry for related CVE-2026-7273 only, not CVE-2026-107441. dateAdded 2026-09-21, dueDate 2026-09-24, knownRansomwareCampaignUse Unknown, forensicTriage Yes, CWE-121. CVE-2026-107441 is not listed (catalog 2026.11.03, checked 4 Nov 2026).","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}],"seenInTheWildLinks":[{"title":"New Zyxel GS1900 pre-auth RCE vulnerability revealed","url":"https://www.binarly.io/blog/zyxel-gs1900-rce-cve-2026-107441","observer":"Binarly","metric":"third-party-stated"},{"title":"Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation","url":"https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation","observer":"GreyNoise","metric":"third-party-stated"}],"whatChanged":{"date":"2026-11-04","items":[{"text":"New catalog page for Zyxel GS1900 pre-auth RCE (CVE-2026-107441) and related KEV-listed CVE-2026-7273.","headline":"New catalog page for Zyxel GS1900 CVE-2026-107441","section":"overview","date":"2026-11-04","kind":"page"},{"text":"Zyxel published the CVE-2026-107441 advisory on 3 Nov 2026. CWE-787 out-of-bounds write in the CGI program. Affected: the ten listed GS1900 models on 2.90(xxxx.2)C0 and earlier, including the .2 builds shipped as the CVE-2026-7273 fix. Fixed: each model's 2.90(xxxx.3)C0. Binarly advisory BRLY-2026-057 dates that firmware release to 22 Oct 2026. Zyxel CNA CVSS 3.1 8.8 (AV:A). Binarly rates 9.8 (AV:N).","headline":"Zyxel discloses CVE-2026-107441; .3 firmware is the fix","section":"fixed-versions","date":"2026-11-04","sourceUrl":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026","alsoSourceUrl":"https://www.binarly.io/advisories/brly-2026-057"},{"text":"Binarly (Fernando Mercês, Yegor Vasilenko, 3 Nov 2026) says the in-the-wild exploit targets CVE-2026-107441 and works on 7273-patched .2 firmware. GreyNoise (21 Sep 2026) had attributed Aug-Sep 2026 activity to CVE-2026-7273 (996 switches in 48 countries). CISA listed CVE-2026-7273 in KEV on 21 Sep 2026. CVE-2026-107441 is not in CISA KEV (catalog 2026.11.03, checked 4 Nov 2026). Zyxel's advisory does not mention exploitation. Badge: Reported exploited. Do not treat 107441 as vendor- or government-verified ITW. No public PoC indexed; Binarly recovered the attacker exploit and plans a later minimized release.","headline":"Reported exploited; 7273 is KEV-listed; 107441 is not","section":"exploitation","date":"2026-11-04","sourceUrl":"https://www.binarly.io/blog/zyxel-gs1900-rce-cve-2026-107441","alsoSourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}]},"whatTheBugIs":"CVE-2026-107441 is an unauthenticated out-of-bounds write (CWE-787) in the web-management CGI on Zyxel GS1900 series switches. Zyxel's 3 Nov 2026 advisory says the flaw in the CGI program could allow a LAN-based, unauthenticated attacker to exploit it and potentially execute OS commands via a crafted HTTP request. The Zyxel CNA / NVD record (published 3 Nov 2026 02:16 UTC, lastModified 4 Nov 2026, status Awaiting Analysis when read 4 Nov 2026) scores CVSS 3.1 8.8 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Binarly advisory BRLY-2026-057 (3 Nov 2026) names dispatcher.cgi and rates CVSS 3.1 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), saying the team treats the management service as network-reachable and that successful use runs OS commands with root privileges. This page stores the Zyxel CNA 8.8 metric and keeps the Binarly 9.8 figure dated and labeled. FIRST EPSS on 3 Nov 2026: 0.00293 (21.968th percentile).\n\nAttribution dispute (read this first): GreyNoise (21 Sep 2026) and CISA KEV (21 Sep 2026) attributed Aug-Sep 2026 GS1900 activity to related CVE-2026-7273, a CWE-121 stack-based buffer overflow that Zyxel patched in June 2026 with 2.90(xxxx.2)C0 builds. Binarly (3 Nov 2026) says the recovered in-the-wild exploit targets CVE-2026-107441 instead, and that the same exploit works without changes on 2.90(AAHL.2)C0, the GS1900-24 build shipped as the 7273 fix. Binarly's two readings: either the 7273 patch missed the flaw, or the Aug-Sep activity was tied to the wrong CVE. Zyxel's 107441 advisory does not mention exploitation. CVE-2026-107441 is not in CISA KEV (catalog 2026.11.03, released 2026-11-03T20:00:24.8741Z, 1,767 entries, checked 4 Nov 2026). Related CVE-2026-7273 remains KEV-listed (dateAdded 2026-09-21, dueDate 2026-09-24). Badge: Reported exploited. Do not treat 107441 as vendor- or government-verified ITW. CISA ADP SSVC on the 107441 NVD record (timestamp 2026-11-03) has Exploitation: none; that is not a KEV listing.\n\nZyxel lists ten models: GS1900-8, GS1900-8HP, GS1900-10HP, GS1900-16, GS1900-24, GS1900-24E, GS1900-24EP, GS1900-24HPv2, GS1900-48, and GS1900-48HPv2. Affected: each model's 2.90(xxxx.2)C0 and earlier. Fixed: the matching 2.90(xxxx.3)C0. Zyxel also writes that on-market products not listed in that table remain unaffected. The community V2.90 Patch 3 post (dated 23 Oct 2026, edited 3 Nov 2026) names the same .3 builds and says they fix a pre-authentication out-of-bounds write (CVE-2026-107441). Binarly's advisory dates that firmware release to 22 Oct 2026. NAT, port-forward, or VPN exposure: no source we opened stated that; dropped.\n\nBinarly recovered the attacker exploit from an open directory on a JITTERLY C2 host and plans a later minimized proof-of-concept. This page does not index a PoC and does not copy exploit code, request bodies, or weaponisation steps. Credit: Binarly (Fernando Mercês, Yegor Vasilenko) disclosure 3 Nov 2026; Zyxel thanks Yegor Vasilenko. GreyNoise (Andrew Thompson, Mark Mager, 21 Sep 2026) first reported the Aug-Sep switch thefts. Acronis TRU (13 Sep 2026) named JITTERLY and SIXZUT in a separate Gitea campaign; Binarly ties the GS1900 exploit host to that operator.","attackPath":{"caption":"High-level only. Not a reproduction guide. No request body, offsets, or command examples.","steps":[{"id":"reach","label":"Reach the web UI","detail":"Zyxel: LAN-based access to the GS1900 web-management service. CVE record: unauthenticated adjacent attacker. Binarly rates the same path as network-reachable (AV:N)."},{"id":"app","label":"Crafted HTTP request","detail":"One crafted HTTP request to the web-management CGI. Conceptual impact class only. No path parameters or payloads here."},{"id":"unsafe","label":"Out-of-bounds write","detail":"CWE-787 write past a fixed CGI buffer. Zyxel and Binarly both describe missing size or count checks. No internals here."},{"id":"exec","label":"OS command execution","detail":"Zyxel: potentially execute OS commands. Binarly: root privileges. This page does not name the follow-on binary."},{"id":"follow","label":"Optional data theft","detail":"GreyNoise (attributed then to CVE-2026-7273): stolen switch configs, networking data, and hashed root credentials. Binarly later ties the recovered exploit to CVE-2026-107441."}]},"exploitation":{"kev":{"listed":false,"date":"2026-11-03","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","note":"CVE-2026-107441 is not in CISA KEV (checked 4 Nov 2026) against catalog 2026.11.03 (released 2026-11-03T20:00:24.8741Z, 1,767 entries). Related CVE-2026-7273 is KEV-listed: dateAdded 2026-09-21, dueDate 2026-09-24, knownRansomwareCampaignUse Unknown, forensicTriage Yes, CWE-121. No KEV chip on 107441."},"firstSeen":{"date":"2026-11-03","source":"Binarly","note":"Reported exploited (Binarly, 3 Nov 2026): the recovered in-the-wild exploit targets CVE-2026-107441 and works on 7273-patched .2 firmware. GreyNoise (21 Sep 2026) attributed Aug-Sep activity (from on or about 17 Aug 2026; 996 switches in 48 countries) to CVE-2026-7273. CISA listed 7273 in KEV on 21 Sep 2026. Zyxel's 3 Nov 2026 advisory does not mention exploitation. First calendar day of 107441 use: not verified. Badge: Reported exploited. Do not treat 107441 as vendor- or government-verified ITW."},"vendorStatements":[],"attributionDispute":"Attribution disputed: GreyNoise and CISA (21 Sep 2026) tied the Aug–Sep GS1900 attacks to CVE-2026-7273; Binarly (3 Nov 2026) says the recovered exploit targets CVE-2026-107441 and works on 7273-patched .2 firmware."},"timeline":[{"date":"2026-06-16","event":"Zyxel published the CVE-2026-7273 advisory and .2 firmware for the same ten GS1900 models. CWE-121 stack-based buffer overflow. LAN-based, unauthenticated, crafted HTTP request. CVSS 3.1 8.8 (AV:A).","source":{"title":"Zyxel security advisory for stack-based buffer overflow in GS1900 series switches","url":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-stack-based-buffer-overflow-vulnerability-in-gs1900-series-switches-06-16-2026","publisher":"Zyxel"},"kind":"advisory","key":true,"addedDate":"2026-11-04"},{"date":"2026-08-17","event":"GreyNoise: on or about this day, an actor stole configs, networking data, and hashed root credentials from 996 GS1900 switches in 48 countries. GreyNoise attributed that activity to CVE-2026-7273. 564 victims had factory default credentials. Binarly later says the recovered exploit targets CVE-2026-107441.","source":{"title":"Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation","url":"https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation","publisher":"GreyNoise"},"kind":"reported","key":true,"addedDate":"2026-11-04"},{"date":"2026-09-13","event":"Acronis TRU published Red Heron exploits Gitea n-day flaw, naming the JITTERLY Linux implant and the SIXZUT rootkit. That post is about Gitea (CVE-2026-60004), not GS1900. Binarly later ties the GS1900 exploit host to the JITTERLY/SIXZUT operator.","source":{"title":"Red Heron exploits Gitea n-day flaw in multinational campaign, exposing new Linux rootkit","url":"https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/","publisher":"Acronis TRU"},"kind":"disclosure","addedDate":"2026-11-04"},{"date":"2026-09-21","event":"GreyNoise published Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation (Andrew Thompson, Mark Mager). First public write-up of the GS1900 thefts, attributed there to CVE-2026-7273.","source":{"title":"Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation","url":"https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation","publisher":"GreyNoise"},"kind":"reported","key":true,"addedDate":"2026-11-04"},{"date":"2026-09-21","event":"CISA listed related CVE-2026-7273 in KEV (due 24 Sep 2026). This is not a KEV listing of CVE-2026-107441.","source":{"title":"CISA Known Exploited Vulnerabilities catalog","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","publisher":"CISA"},"kind":"other","key":true,"addedDate":"2026-11-04"},{"date":"2026-09-22","event":"Help Net Security summarised the GreyNoise 21 Sep 2026 GS1900 report (996 devices, 48 countries, 564 default credentials, CISA KEV due 24 Sep 2026).","source":{"title":"Attacker compromised nearly 1000 Zyxel switches since August (CVE-2026-7273)","url":"https://www.helpnetsecurity.com/2026/09/22/zyxel-switches-cve-2026-7273-vulnerability-exploited/","publisher":"Help Net Security"},"kind":"other","addedDate":"2026-11-04"},{"date":"2026-09-28","event":"Binarly advisory timeline: the team recorded that all ten CVE-2026-7273 fixed releases remained affected by the recovered exploit.","source":{"title":"BRLY-2026-057","url":"https://www.binarly.io/advisories/brly-2026-057","publisher":"Binarly"},"kind":"other","addedDate":"2026-11-04"},{"date":"2026-09-29","event":"Binarly advisory timeline: Zyxel PSIRT notified.","source":{"title":"BRLY-2026-057","url":"https://www.binarly.io/advisories/brly-2026-057","publisher":"Binarly"},"kind":"disclosure","addedDate":"2026-11-04"},{"date":"2026-10-08T02:07:52.349Z","event":"Zyxel reserved CVE-2026-107441 (CVE record dateReserved). Binarly's advisory timeline instead dates Zyxel confirmation and reservation to 11 Oct 2026.","source":{"title":"CVE-2026-107441 (Zyxel CNA)","url":"https://cveawg.mitre.org/api/cve/CVE-2026-107441","publisher":"Zyxel / CVE.org"},"kind":"disclosure","addedDate":"2026-11-04"},{"date":"2026-10-22","event":"Binarly advisory: Zyxel released the CVE-2026-107441 .3 firmware. The community V2.90 Patch 3 post is dated 23 Oct 2026 (edited 3 Nov 2026) and names the same model builds.","source":{"title":"BRLY-2026-057 disclosure timeline","url":"https://www.binarly.io/advisories/brly-2026-057","publisher":"Binarly"},"kind":"patch","key":true,"addedDate":"2026-11-04"},{"date":"2026-10-23","event":"Zyxel Community published Switch GS1900 Series V2.90 Patch 3 Firmware Release (edited 3 Nov 2026). Bug fix line: pre-authentication out-of-bounds write (CVE-2026-107441). Lists the ten .3 builds, plus GS1900-8HP Rev. B1 on 2.90(AAHI.3)C0.","source":{"title":"Switch GS1900 Series - V2.90 Patch 3 Firmware Release","url":"https://community.zyxel.com/en/discussion/34420/switch-gs1900-series-v2-90-patch-3-firmware-release","publisher":"Zyxel Community"},"kind":"patch","addedDate":"2026-11-04"},{"date":"2026-11-03T00:00:00.000Z","event":"Binarly published BRLY-2026-057 (article published_time 2026-11-03T00:00:00.000Z). Out-of-bounds write in dispatcher.cgi; CVSS 3.1 9.8 (AV:N); root privileges.","source":{"title":"BRLY-2026-057","url":"https://www.binarly.io/advisories/brly-2026-057","publisher":"Binarly"},"kind":"advisory","key":true,"addedDate":"2026-11-04"},{"date":"2026-11-03T01:41:52.029Z","event":"Zyxel CNA published CVE-2026-107441. CVSS 3.1 8.8 (AV:A). CWE-787. NVD published the record at 02:16:52 UTC.","source":{"title":"CVE-2026-107441 (Zyxel CNA)","url":"https://cveawg.mitre.org/api/cve/CVE-2026-107441","publisher":"Zyxel / CVE.org"},"kind":"disclosure","addedDate":"2026-11-04"},{"date":"2026-11-03","event":"Zyxel published the CVE-2026-107441 advisory (revision 2026-11-3). Ten GS1900 models. .2 and earlier affected; .3 fixed. Credit: Yegor Vasilenko, Binarly. The advisory does not mention exploitation.","source":{"title":"Zyxel security advisory for out-of-bounds write in GS1900 series switches","url":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026","publisher":"Zyxel"},"kind":"advisory","key":true,"addedDate":"2026-11-04"},{"date":"2026-11-03T05:22:44.250Z","event":"Binarly published the GS1900 blog (Fernando Mercês, Yegor Vasilenko). Reported in-the-wild exploit for CVE-2026-107441; JITTERLY/SIXZUT IOCs; planned later minimized proof-of-concept. This page does not index a PoC.","source":{"title":"New Zyxel GS1900 pre-auth RCE vulnerability revealed","url":"https://www.binarly.io/blog/zyxel-gs1900-rce-cve-2026-107441","publisher":"Binarly"},"kind":"reported","key":true,"addedDate":"2026-11-04"},{"date":"2026-11-03","event":"Not in CISA KEV. Catalog 2026.11.03 released 2026-11-03T20:00:24.8741Z (1,767 entries). Rechecked 4 Nov 2026. CVE-2026-107441 is not listed. Related CVE-2026-7273 remains listed from 21 Sep 2026.","source":{"title":"CISA Known Exploited Vulnerabilities catalog","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","publisher":"CISA"},"kind":"other","addedDate":"2026-11-04"},{"date":"2026-11-04","event":"SecurityOnline summarised Binarly's 3 Nov 2026 disclosure: exploit works on 7273-patched firmware; firmware dated 22 Oct 2026; no public PoC yet.","source":{"title":"Zyxel GS1900 Zero-Day CVE-2026-107441 Exploited in the Wild, Bypassing Earlier Patch","url":"https://securityonline.info/zyxel-gs1900-zero-day-cve-2026-107441/","publisher":"SecurityOnline"},"kind":"other","addedDate":"2026-11-04"}],"openNotes":[{"title":"Which CVE the Aug-Sep 2026 activity used is disputed","detail":"GreyNoise (21 Sep 2026) and CISA KEV (21 Sep 2026) attributed the GS1900 thefts to CVE-2026-7273. Binarly (3 Nov 2026) says the recovered exploit targets CVE-2026-107441 and still works on 7273-patched .2 firmware. This page records both claims dated. It does not resolve them. First calendar day of 107441 use: not verified.","sources":[{"url":"https://www.binarly.io/blog/zyxel-gs1900-rce-cve-2026-107441","date":"2026-11-03","publisher":"Binarly"},{"url":"https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation","date":"2026-09-21","publisher":"GreyNoise"}]},{"title":"CVE reserved date differs by three days","detail":"The CVE record dateReserved is 8 Oct 2026 02:07 UTC. Binarly's advisory timeline says Zyxel accepted the new vulnerability and reserved CVE-2026-107441 on 11 Oct 2026. This page keeps both dates.","sources":[{"url":"https://cveawg.mitre.org/api/cve/CVE-2026-107441","date":"2026-10-08","publisher":"Zyxel / CVE.org"},{"url":"https://www.binarly.io/advisories/brly-2026-057","date":"2026-11-03","publisher":"Binarly"}]},{"title":".3 firmware calendar day","detail":"Binarly's advisory timeline dates the Zyxel .3 firmware release to 22 Oct 2026. The Zyxel Community Patch 3 post is dated 23 Oct 2026 and was edited 3 Nov 2026. This page cites Binarly for 22 Oct and keeps the community post date.","sources":[{"url":"https://www.binarly.io/advisories/brly-2026-057","date":"2026-11-03","publisher":"Binarly"},{"url":"https://community.zyxel.com/en/discussion/34420/switch-gs1900-series-v2-90-patch-3-firmware-release","date":"2026-10-23","publisher":"Zyxel Community"}]}],"defenderActions":[{"title":"Install each model's 2.90(xxxx.3)C0 firmware","detail":"Upgrade is the only full fix. Use the model row in the 3 Nov 2026 Zyxel advisory. Examples: GS1900-24 2.90(AAHL.3)C0, GS1900-24E 2.90(AAHK.3)C0, GS1900-48HPv2 2.90(ABTQ.3)C0. Binarly dates that release to 22 Oct 2026.","priority":"now","links":[{"label":"Zyxel CVE-2026-107441 advisory","href":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026"},{"label":"GS1900 V2.90 Patch 3 release note","href":"https://community.zyxel.com/en/discussion/34420/switch-gs1900-series-v2-90-patch-3-firmware-release"}]},{"title":"Do not treat .2 (7273-fixed) devices as safe","detail":"Binarly: the recovered exploit works without changes on 2.90(AAHL.2)C0, the GS1900-24 build shipped as the CVE-2026-7273 fix. A device that only took the June 2026 .2 build is still in the 107441 affected range.","priority":"now","links":[{"label":"Binarly GS1900 blog","href":"https://www.binarly.io/blog/zyxel-gs1900-rce-cve-2026-107441"}]},{"title":"Keep the web UI on a management VLAN","detail":"Zyxel describes the flaw as LAN-based. Until the .3 build is on, and after it, limit the web UI to networks that must manage the switch. This reduces who can send a crafted request. It does not replace the upgrade.","priority":"now","links":[{"label":"Zyxel CVE-2026-107441 advisory","href":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026"}]},{"title":"Change default credentials","detail":"GreyNoise: 564 of the 996 stolen switches still used factory default credentials. Change admin and root passwords on every GS1900, including devices that already have .3 firmware.","priority":"now","links":[{"label":"GreyNoise Kapibala post","href":"https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation"}]},{"title":"If a switch's web UI was reachable from untrusted networks while on a .2 or older build, investigate it as possibly compromised.","detail":"GreyNoise reported config and hashed-root-credential theft from 996 devices. Binarly recovered a working exploit that also hits .2 firmware. Hunt Detection and Look for past exploitation before you overwrite logs. An upgrade does not undo a prior theft.","priority":"now","links":[{"label":"GreyNoise Kapibala post","href":"https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation"},{"label":"Binarly GS1900 blog","href":"https://www.binarly.io/blog/zyxel-gs1900-rce-cve-2026-107441"}]}],"detection":[{"title":"DNS lookups for 981666[.]xyz","detail":"Binarly (3 Nov 2026): every JITTERLY sample they listed used hostnames under 981666[.]xyz. Hunt DNS logs for that parent domain. A lookup is a lead, not proof this CVE ran on a switch. No public Nuclei, Sigma, or IDS rule for CVE-2026-107441 was found as of 4 Nov 2026.","logSource":"Recursive DNS resolver logs","kind":"generic","group":"web-proxy","url":"https://www.binarly.io/blog/zyxel-gs1900-rce-cve-2026-107441","date":"2026-11-03"},{"title":"HTTP POSTs to GS1900 CGI from non-admin hosts","detail":"Zyxel: crafted HTTP request to the CGI program. Binarly names dispatcher.cgi as the sink. Hunt web or firewall logs for HTTP POSTs to GS1900 management IPs from hosts that are not your admin jump boxes. A POST is reachability plus a request, not proof of code execution. Do not send crafted requests.","logSource":"Firewall, proxy, or switch web-server logs covering GS1900 management IPs","kind":"generic","group":"web-proxy","url":"https://www.binarly.io/advisories/brly-2026-057","date":"2026-11-03"},{"title":"New listeners on switch management IPs, including TCP 2323","detail":"Binarly's write-up shows the recovered tool can open a new listener (example: TCP 2323). Treat any new listener on a management IP as a lead.","logSource":"Flow or firewall logs for GS1900 management IPs","kind":"generic","group":"waf-ips","url":"https://www.binarly.io/blog/zyxel-gs1900-rce-cve-2026-107441","date":"2026-11-03"},{"title":"SIXZUT process hiding of configd on Linux hosts","detail":"Binarly: one SIXZUT sample hides processes named configd and connections to s2.981666[.]xyz:8082. That is host malware on Linux, not a GS1900 firmware artefact. Hunt Linux EDR or process inventory for unexpected configd processes. The compare-/proc-vs-ps method was not in the Binarly blog or advisory; dropped.","logSource":"Linux host process and connection inventory / EDR","kind":"generic","group":"edr","url":"https://www.binarly.io/blog/zyxel-gs1900-rce-cve-2026-107441","date":"2026-11-03"}],"detectionRules":[{"id":"v2s-sigma-zyxel-gs1900-cve-2026-107441-dns","title":"GS1900 actor C2 domain hunt","language":"sigma","query":"title: GS1900 actor C2 domain hunt\nid: 3e8c1a46-9b72-4d0f-8c15-6a2f0d91b4e8\nstatus: experimental\ndescription: Detects DNS queries for the 981666.xyz parent domain that Binarly listed as JITTERLY C2 on 3 Nov 2026. Domain hunt only. Not a payload detector.\nreferences:\n    - https://www.binarly.io/blog/zyxel-gs1900-rce-cve-2026-107441\nauthor: vuln2shell\ndate: 2026-11-04\nlogsource:\n    category: dns\ndetection:\n    selection:\n        query|contains: '981666.xyz'\n    condition: selection\nfalsepositives:\n    - Rare; this domain is not a common enterprise name\nlevel: high","logSource":"Recursive DNS resolver logs","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://www.binarly.io/blog/zyxel-gs1900-rce-cve-2026-107441","sourceDate":"2026-11-03","license":"CC0 1.0","origin":"vuln2shell","notes":"Domain hunt only. A lookup is not proof this CVE ran. Tune the query field name to your shipper. No public Nuclei, Sigma, or IDS rule for CVE-2026-107441 was found as of 4 Nov 2026. Query strings are refanged for matching; IOC tables stay defanged.","tested":"untested"},{"id":"v2s-spl-zyxel-gs1900-cve-2026-107441-dns","title":"GS1900 actor C2 domain hunt (SPL)","language":"spl","query":"index=* (sourcetype=stream:dns OR sourcetype=cisco:ise:syslog OR sourcetype=pan:threat)\n\"981666.xyz\"\n| stats count min(_time) as firstTime max(_time) as lastTime values(src) as src by query, dest\n| convert ctime(firstTime) ctime(lastTime)","logSource":"Recursive DNS resolver logs","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://www.binarly.io/blog/zyxel-gs1900-rce-cve-2026-107441","sourceDate":"2026-11-03","license":"CC0 1.0","origin":"vuln2shell","notes":"Domain hunt only. Tune sourcetype and query fields to your shipper. Query strings are refanged for matching; IOC tables stay defanged.","tested":"untested"},{"id":"v2s-kql-zyxel-gs1900-cve-2026-107441-dns","title":"GS1900 actor C2 domain hunt (KQL)","language":"kql","query":"DnsEvents\n| where TimeGenerated > ago(14d)\n| where Name has \"981666.xyz\"\n| summarize count() , min(TimeGenerated), max(TimeGenerated) by Computer, ClientIP, Name\n| order by count_ desc","logSource":"Microsoft Sentinel DnsEvents or equivalent DNS table","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://www.binarly.io/blog/zyxel-gs1900-rce-cve-2026-107441","sourceDate":"2026-11-03","license":"CC0 1.0","origin":"vuln2shell","notes":"Map DnsEvents and Name to your DNS ingest. Domain hunt only. Query strings are refanged for matching; IOC tables stay defanged.","tested":"untested"},{"id":"v2s-esql-zyxel-gs1900-cve-2026-107441-dns","title":"GS1900 actor C2 domain hunt (ES|QL)","language":"esql","query":"FROM logs-*\n| WHERE dns.question.name LIKE \"*981666.xyz\"\n| STATS count = COUNT(*), first = MIN(@timestamp), last = MAX(@timestamp) BY host.name, source.ip, dns.question.name","logSource":"DNS logs shipped to Elastic","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://www.binarly.io/blog/zyxel-gs1900-rce-cve-2026-107441","sourceDate":"2026-11-03","license":"CC0 1.0","origin":"vuln2shell","notes":"Domain hunt only. Index and field names vary by ingest pipeline. Query strings are refanged for matching; IOC tables stay defanged.","tested":"untested"},{"id":"v2s-sigma-zyxel-gs1900-cve-2026-107441-cgi","title":"GS1900 CGI POST hunt","language":"sigma","query":"title: GS1900 CGI POST hunt\nid: 9a14d2c0-5e38-4b71-91aa-0c4d8e27f6b1\nstatus: experimental\ndescription: Detects HTTP POST requests to the GS1900 CGI path named by Binarly for CVE-2026-107441. Path hunt only. Not a payload detector.\nreferences:\n    - https://www.binarly.io/advisories/brly-2026-057\nauthor: vuln2shell\ndate: 2026-11-04\nlogsource:\n    category: webserver\ndetection:\n    selection:\n        cs-method: 'POST'\n        cs-uri-stem|contains: 'dispatcher.cgi'\n    condition: selection\nfalsepositives:\n    - Legitimate GS1900 web-UI administration from approved jump hosts\nlevel: informational","logSource":"Firewall, proxy, or switch web-server logs covering GS1900 management IPs","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://www.binarly.io/advisories/brly-2026-057","sourceDate":"2026-11-03","license":"CC0 1.0","origin":"vuln2shell","notes":"Path hunt only. A POST is not proof of compromise. Compare sources to your admin inventory. Do not send crafted requests. Query strings are refanged for matching; IOC tables stay defanged.","tested":"untested"},{"id":"v2s-spl-zyxel-gs1900-cve-2026-107441-listener","title":"GS1900 management-IP new listener hunt (SPL)","language":"spl","query":"index=* (sourcetype=stream:tcp OR sourcetype=cisco:asa OR sourcetype=pan:traffic)\ndest_port=2323\n| stats count min(_time) as firstTime max(_time) as lastTime values(src) as src by dest, dest_port\n| convert ctime(firstTime) ctime(lastTime)","logSource":"Flow or firewall logs for GS1900 management IPs","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://www.binarly.io/blog/zyxel-gs1900-rce-cve-2026-107441","sourceDate":"2026-11-03","license":"CC0 1.0","origin":"vuln2shell","notes":"Binarly's write-up shows the recovered tool can open a new listener (example: TCP 2323). Treat any new listener on a management IP as a lead. Scope dest to your GS1900 management IPs. Query strings are refanged for matching; IOC tables stay defanged.","tested":"untested"}],"detectionLinks":[{"title":"Binarly GS1900 blog (JITTERLY / SIXZUT YARA on the page)","url":"https://www.binarly.io/blog/zyxel-gs1900-rce-cve-2026-107441","author":"Fernando Mercês, Yegor Vasilenko / Binarly","date":"2026-11-03","note":"The blog includes JITTERLY and SIXZUT YARA. This site links it only and does not copy the rules."},{"title":"BRLY-2026-057","url":"https://www.binarly.io/advisories/brly-2026-057","author":"Binarly","date":"2026-11-03","note":"Names dispatcher.cgi. This site does not copy internals or payloads."}],"retrohunt":{"summary":"If a GS1900 web UI was reachable from untrusted networks from 17 Aug 2026, hunt DNS for 981666[.]xyz, HTTP POSTs to the CGI from non-admin hosts, new listeners on management IPs, and Linux hosts for SIXZUT hiding of configd. Binarly's write-up shows the recovered tool can open a new listener (example: TCP 2323). Treat any new listener on a management IP as a lead.","lookback":{"from":"2026-08-17","basis":"first-exploitation","rationale":"GreyNoise dated the GS1900 thefts to on or about 17 Aug 2026 and attributed them to CVE-2026-7273. Binarly later says the recovered exploit targets CVE-2026-107441. Hunt from that day. First calendar day of 107441 use: not verified.","sources":[{"url":"https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation","date":"2026-09-21","publisher":"GreyNoise"},{"url":"https://www.binarly.io/blog/zyxel-gs1900-rce-cve-2026-107441","date":"2026-11-03","publisher":"Binarly"}],"searchLine":"Search from 17 Aug 2026 (GreyNoise's earliest reported GS1900 activity, attributed there to CVE-2026-7273). This date is a lower bound, not a verified first day for CVE-2026-107441."},"logSources":[{"name":"Recursive DNS resolver logs","why":"Binarly listed 981666[.]xyz as the JITTERLY C2 parent domain.","required":true},{"name":"Firewall, proxy, or switch web-server logs covering GS1900 management IPs","why":"Zyxel names a crafted HTTP request to the CGI. Binarly names dispatcher.cgi.","required":true},{"name":"Flow or firewall logs for GS1900 management IPs","why":"Binarly's write-up shows the recovered tool can open a new listener (example: TCP 2323). Treat any new listener on a management IP as a lead.","required":false},{"name":"Linux host process and connection inventory / EDR","why":"Binarly: SIXZUT hides processes named configd and connections to s2.981666[.]xyz:8082.","required":false}],"steps":[{"title":"List DNS lookups for 981666[.]xyz since 17 Aug 2026","detail":"Search resolver logs for the parent domain Binarly listed. A lookup is a lead, not proof a switch was hit.","sources":[{"url":"https://www.binarly.io/blog/zyxel-gs1900-rce-cve-2026-107441","date":"2026-11-03","publisher":"Binarly"}]},{"title":"List HTTP POSTs to GS1900 CGI from non-admin hosts","detail":"Search web or firewall logs for POSTs to dispatcher.cgi on GS1900 management IPs from 17 Aug 2026. Compare sources to the admin inventory. Do not send crafted requests.","sources":[{"url":"https://www.binarly.io/advisories/brly-2026-057","date":"2026-11-03","publisher":"Binarly"}]},{"title":"Review new listeners on management IPs","detail":"Binarly's write-up shows the recovered tool can open a new listener (example: TCP 2323). Treat any new listener on a management IP as a lead.","sources":[{"url":"https://www.binarly.io/blog/zyxel-gs1900-rce-cve-2026-107441","date":"2026-11-03","publisher":"Binarly"}]}],"queries":[{"id":"v2s-spl-zyxel-gs1900-cve-2026-107441-retrohunt-dns","title":"981666[.]xyz DNS since 17 Aug 2026","language":"spl","query":"index=* \"981666.xyz\" earliest=08/17/2026:00:00:00\n| stats count min(_time) as firstTime max(_time) as lastTime values(src) as src by query\n| convert ctime(firstTime) ctime(lastTime)","logSource":"Recursive DNS resolver logs","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://www.binarly.io/blog/zyxel-gs1900-rce-cve-2026-107441","sourceDate":"2026-11-03","license":"CC0 1.0","origin":"vuln2shell","notes":"Lookback from GreyNoise's on-or-about 17 Aug 2026 date. Tune sourcetype to your shipper.","tested":"untested","timeRange":"From 17 Aug 2026 (GreyNoise first-activity date, then attributed to CVE-2026-7273) through the last .3 patch window"}],"thirdPartyQueries":[{"title":"Binarly JITTERLY and SIXZUT YARA (on the blog)","url":"https://www.binarly.io/blog/zyxel-gs1900-rce-cve-2026-107441","author":"Binarly","date":"2026-11-03","language":"yara","license":"See Binarly blog","origin":"community","note":"Link only. This site does not copy the YARA bodies."}],"artefacts":[{"kind":"web-log","value":"HTTP POST to dispatcher.cgi on a GS1900 management IP","detail":"Binarly names that CGI. A request is reachability plus a POST, not proof of code execution.","sourceUrl":"https://www.binarly.io/advisories/brly-2026-057","sourceDate":"2026-11-03"},{"kind":"network","value":"New listener on a GS1900 management IP, including TCP 2323","detail":"Binarly's write-up shows the recovered tool can open a new listener (example: TCP 2323). Treat any new listener on a management IP as a lead.","sourceUrl":"https://www.binarly.io/blog/zyxel-gs1900-rce-cve-2026-107441","sourceDate":"2026-11-03"},{"kind":"process","value":"Linux process named configd hidden by SIXZUT","detail":"Binarly: one SIXZUT sample hides processes named configd and connections to s2.981666[.]xyz:8082. Host malware, not a switch firmware artefact.","sourceUrl":"https://www.binarly.io/blog/zyxel-gs1900-rce-cve-2026-107441","sourceDate":"2026-11-03"}],"iocs":[{"type":"domain","value":"981666[.]xyz","context":"Binarly (3 Nov 2026): parent C2 domain used by every listed JITTERLY sample, varying only hostname, port, and AES keys.","sourceUrl":"https://www.binarly.io/blog/zyxel-gs1900-rce-cve-2026-107441","sourceDate":"2026-11-03"},{"type":"ip","value":"104.223.65[.]148","context":"Binarly: p2.981666[.]xyz. JITTERLY C2 on TCP 8080; open directories on TCP 80 and 18081 (gs1900_bundle.tar.gz hosted there).","sourceUrl":"https://www.binarly.io/blog/zyxel-gs1900-rce-cve-2026-107441","sourceDate":"2026-11-03"},{"type":"ip","value":"104.225.153[.]141","context":"Binarly: s2.981666[.]xyz and several other s-hostnames. JITTERLY C2 on TCP 5432, 6379, and 8082.","sourceUrl":"https://www.binarly.io/blog/zyxel-gs1900-rce-cve-2026-107441","sourceDate":"2026-11-03"},{"type":"ip","value":"166.88.227[.]181","context":"Binarly: s7.981666[.]xyz. JITTERLY C2 on TCP 443.","sourceUrl":"https://www.binarly.io/blog/zyxel-gs1900-rce-cve-2026-107441","sourceDate":"2026-11-03"},{"type":"ip","value":"203.88.123[.]148","context":"Binarly: s0.981666[.]xyz and s1.981666[.]xyz. SoybeanAdmin panel on TCP 80 and OpenSSH on TCP 22.","sourceUrl":"https://www.binarly.io/blog/zyxel-gs1900-rce-cve-2026-107441","sourceDate":"2026-11-03"},{"type":"hash","value":"82d072ab03d90c0131b06a576eadf2c986a51f0de986d50db4e49be01bf125cb","context":"Binarly table: JITTERLY SHA-256. C2 p1.981666[.]xyz:6443. Embedded SIXZUT 295133156b6a7d95b9c92f832f49e35235f1fbd3906e75c9202ef4cd65d1018c.","sourceUrl":"https://www.binarly.io/blog/zyxel-gs1900-rce-cve-2026-107441","sourceDate":"2026-11-03"},{"type":"hash","value":"663a8088faca8e126a11648f5671fcf4eaf96435e10daf63a1d1b17d8385154c","context":"Binarly table: JITTERLY SHA-256. C2 p2.981666[.]xyz:8080. Embedded SIXZUT 64677002011bc2e4bc642a4154a20fdb95620ebd0144b98fc60f917901ec8b92.","sourceUrl":"https://www.binarly.io/blog/zyxel-gs1900-rce-cve-2026-107441","sourceDate":"2026-11-03"},{"type":"hash","value":"0f6e757e82c4d91df5bd249f775b9970b59dee42cc0dfe40f879d77fc16821c6","context":"Binarly table: JITTERLY SHA-256. C2 s2.981666[.]xyz:8082. Embedded SIXZUT 728810b07e911b235f6450e784391e39f68819a0a5d209662162916ffea25146.","sourceUrl":"https://www.binarly.io/blog/zyxel-gs1900-rce-cve-2026-107441","sourceDate":"2026-11-03"},{"type":"hash","value":"295133156b6a7d95b9c92f832f49e35235f1fbd3906e75c9202ef4cd65d1018c","context":"Binarly table: embedded SIXZUT SHA-256 for JITTERLY 82d072ab03d90c0131b06a576eadf2c986a51f0de986d50db4e49be01bf125cb.","sourceUrl":"https://www.binarly.io/blog/zyxel-gs1900-rce-cve-2026-107441","sourceDate":"2026-11-03"},{"type":"hash","value":"64677002011bc2e4bc642a4154a20fdb95620ebd0144b98fc60f917901ec8b92","context":"Binarly table: embedded SIXZUT SHA-256 for JITTERLY 663a8088faca8e126a11648f5671fcf4eaf96435e10daf63a1d1b17d8385154c.","sourceUrl":"https://www.binarly.io/blog/zyxel-gs1900-rce-cve-2026-107441","sourceDate":"2026-11-03"},{"type":"hash","value":"728810b07e911b235f6450e784391e39f68819a0a5d209662162916ffea25146","context":"Binarly table: embedded SIXZUT SHA-256 for JITTERLY 0f6e757e82c4d91df5bd249f775b9970b59dee42cc0dfe40f879d77fc16821c6. Binarly: hides processes named configd.","sourceUrl":"https://www.binarly.io/blog/zyxel-gs1900-rce-cve-2026-107441","sourceDate":"2026-11-03"}],"iocNote":"IOCs above appear verbatim in the Binarly 3 Nov 2026 blog tables (defanged as published). Extra YARA hash= fields that were not in those tables are omitted. AES keys are omitted. ctxsec-only indicators were not added.","hitMeaning":[{"level":"attempt","detail":"DNS lookup for 981666[.]xyz, or an HTTP POST to dispatcher.cgi on a GS1900 management IP from a non-admin host, with no new listener and no stolen-config evidence."},{"level":"likely-compromise","detail":"Those requests plus a new listener on the management IP, or a Linux host hiding configd / talking to 981666[.]xyz, on a switch below the listed .3 build that was reachable from 17 Aug 2026. Binarly's write-up shows the recovered tool can open a new listener (example: TCP 2323). Treat any new listener on a management IP as a lead."},{"level":"compromise","detail":"Evidence that attacker-controlled commands ran on the switch, or that configs / hashed root credentials left the device. GreyNoise reported that class of theft and attributed it then to CVE-2026-7273. Independent validation of 107441 as the CVE used that day: not verified.","label":"Compromise (your evidence)"}],"nextSteps":[{"title":"Install .3 firmware and restrict the web UI","detail":"Upgrade to the model-specific 2.90(xxxx.3)C0 build. Keep the web UI on a management VLAN. Change default credentials.","links":[{"label":"Zyxel CVE-2026-107441 advisory","href":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026"}]},{"title":"Preserve DNS, web, and flow logs before upgrade","detail":"Keep copies of resolver logs, GS1900 web or firewall logs, and management-IP flow logs from 17 Aug 2026 onward before restore or upgrade.","links":[{"label":"Binarly GS1900 blog","href":"https://www.binarly.io/blog/zyxel-gs1900-rce-cve-2026-107441"}]}],"limits":["Zyxel has not stated exploitation of CVE-2026-107441.","GreyNoise attributed the Aug-Sep thefts to CVE-2026-7273. Binarly later says the recovered exploit targets CVE-2026-107441.","First calendar day of 107441 use: not verified.","A DNS lookup or CGI POST is not proof of compromise.","Binarly's write-up shows the recovered tool can open a new listener (example: TCP 2323). Treat any new listener on a management IP as a lead.","No public Nuclei, Sigma, or IDS rule was found as of 4 Nov 2026."],"sources":[{"url":"https://www.binarly.io/blog/zyxel-gs1900-rce-cve-2026-107441","date":"2026-11-03","publisher":"Binarly"},{"url":"https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation","date":"2026-09-21","publisher":"GreyNoise"},{"url":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026","date":"2026-11-03","publisher":"Zyxel"}],"updatedAt":"2026-11-04"},"amIAffected":{"summary":"The ten GS1900 models in Zyxel's 3 Nov 2026 table on 2.90(xxxx.2)C0 and earlier, including the .2 builds shipped as the CVE-2026-7273 fix. Fixed: each model's 2.90(xxxx.3)C0. Preconditions: unauthenticated access to the web-management CGI. Zyxel describes that as LAN-based.","checks":[{"id":"v2s-aia-zyxel-gs1900-cve-2026-107441-version-1","kind":"version","title":"Record the model and firmware version","detail":"On each GS1900, record the model and the firmware string shown in the web UI (or the equivalent CLI the device already offers). Compare it to the advisory table. Do not send crafted HTTP requests.","command":"On each GS1900, open the web UI and record Model plus Firmware Version from the system information page. Compare the string to the 3 Nov 2026 Zyxel table (for example GS1900-24 2.90(AAHL.3)C0).","affectedMeans":"The model is one of the ten listed GS1900 SKUs and the firmware is 2.90(xxxx.2)C0 or earlier, including a .2 build shipped as the CVE-2026-7273 fix.","fixedMeans":"The firmware is the model-specific 2.90(xxxx.3)C0 build from the 3 Nov 2026 advisory.","notes":"Inventory only. The community Patch 3 post also lists GS1900-8HP Rev. B1 on 2.90(AAHI.3)C0. No sourced show-version CLI was found; use the UI string the device already displays.","sources":[{"url":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026","date":"2026-11-03","publisher":"Zyxel"},{"url":"https://community.zyxel.com/en/discussion/34420/switch-gs1900-series-v2-90-patch-3-firmware-release","date":"2026-10-23","publisher":"Zyxel Community"}]},{"id":"v2s-aia-zyxel-gs1900-cve-2026-107441-config-2","kind":"config","title":"Record whether untrusted networks can reach the web UI","detail":"Zyxel: LAN-based unauthenticated attacker. Record which VLANs or subnets can complete a TCP connection to the web UI. Do not send application requests.","command":"On each GS1900, record the management VLAN or listen address from the web UI, and whether untrusted networks can complete a TCP connection to the HTTP or HTTPS management port.","affectedMeans":"The switch is below a listed .3 build and untrusted networks can reach the web UI.","fixedMeans":"The switch is on a listed .3 build, or untrusted networks cannot complete a TCP connection to the web UI (workaround only).","notes":"Network restriction is a workaround, not a firmware fix. Zyxel did not publish a NAT, port-forward, or VPN exposure statement.","sources":[{"url":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026","date":"2026-11-03","publisher":"Zyxel"}]},{"id":"v2s-aia-zyxel-gs1900-cve-2026-107441-config-3","kind":"config","title":"Record whether default credentials are still in use","detail":"GreyNoise: 564 of 996 stolen switches still used factory default credentials. Record whether the admin or root password is still the factory default. Do not test a login from an untrusted host.","command":"On each GS1900, compare the current admin password policy against the factory default listed in that model's hardware guide. Record default or changed. Do not attempt a login as a test from outside the management network.","affectedMeans":"The switch is below a listed .3 build, or it still uses factory default credentials (exposure even after patch if creds were stolen).","fixedMeans":"The switch is on a listed .3 build and the admin and root passwords are no longer factory defaults.","notes":"Changing defaults is not a firmware fix. Stolen hashed credentials remain a rotation item if the web UI was reachable before .3.","sources":[{"url":"https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation","date":"2026-09-21","publisher":"GreyNoise"}]}],"limits":["No sourced Shodan or Censys fingerprint for this CVE. Do not invent one.","No public internet-host count was published for CVE-2026-107441.","The UI version string does not prove a remote stack is patched.","A .2 build is the CVE-2026-7273 fix and is still in the 107441 affected range."],"sources":[{"url":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026","date":"2026-11-03","publisher":"Zyxel"},{"url":"https://www.binarly.io/blog/zyxel-gs1900-rce-cve-2026-107441","date":"2026-11-03","publisher":"Binarly"},{"url":"https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation","date":"2026-09-21","publisher":"GreyNoise"}],"updatedAt":"2026-11-04","addedDate":"2026-11-04"},"mitigations":{"summary":"Zyxel published no workaround beyond installing .3 firmware. Until you can patch, keep the web UI on a management VLAN (Zyxel LAN-based wording; Binarly and SecurityOnline also say this) and change factory default credentials (GreyNoise).","items":[{"title":"Keep the web UI on a management VLAN","detail":"Zyxel describes CVE-2026-107441 as LAN-based. Limit HTTP and HTTPS management to the networks that must administer the switch. Binarly and SecurityOnline (4 Nov 2026) also say to keep the web UI off untrusted networks.","limits":"Not a firmware fix. An attacker already on the management LAN remains in scope. Still install .3.","verify":"Untrusted networks can no longer complete a TCP connection to the GS1900 HTTP or HTTPS management port. Confirm in the edge firewall or switch ACL, then re-check after the next change window. Do not send application requests.","source":{"url":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026","date":"2026-11-03","publisher":"Zyxel"}},{"title":"Change factory default credentials","detail":"GreyNoise (21 Sep 2026): 564 of 996 stolen switches still used factory default credentials. Set a unique admin password on every GS1900.","limits":"Not a firmware fix. Hashed credentials already stolen remain a rotation item. Still install .3.","verify":"A login with the factory default admin password fails on each switch. Confirm from a management-network host, then re-check after the next change window.","source":{"url":"https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation","date":"2026-09-21","publisher":"GreyNoise"}}],"updatedAt":"2026-11-04","addedDate":"2026-11-04"},"response":{"summary":"Isolate the web UI, install the model-specific .3 firmware, and change credentials. If a switch below .3 was reachable from 17 Aug 2026, preserve DNS, web, and flow logs and treat stolen configs plus hashed root credentials as exposed. No sourced in-the-wild persistence path on the switch itself.","containment":[{"title":"Remove untrusted networks from the web UI","detail":"Allow HTTP and HTTPS management only from the management VLAN.","sources":[{"url":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026","date":"2026-11-03","publisher":"Zyxel"}]},{"title":"Install the model-specific .3 firmware","detail":"Upgrade to the 2.90(xxxx.3)C0 build for that SKU. An upgrade does not replace log review if the web UI was reachable while vulnerable.","sources":[{"url":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026","date":"2026-11-03","publisher":"Zyxel"}]},{"title":"Change admin and root passwords","detail":"GreyNoise reported theft of hashed root credentials. Change those passwords even after the .3 build is installed.","sources":[{"url":"https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation","date":"2026-09-21","publisher":"GreyNoise"}]}],"rotate":[{"item":"GS1900 admin and root passwords","reason":"GreyNoise: the actor stole hashed root-level credentials from 996 switches. 564 still used factory defaults.","sources":[{"url":"https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation","date":"2026-09-21","publisher":"GreyNoise"}]},{"item":"Secrets stored in stolen switch configs (SNMP, TACACS, downstream device passwords)","reason":"GreyNoise: the actor also took device configurations and networking information. Rotate anything those configs could hold if the web UI was reachable before .3.","generic":true,"sources":[{"url":"https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation","date":"2026-09-21","publisher":"GreyNoise"}]}],"observedBehaviour":[{"title":"Config and hashed-root-credential theft","detail":"GreyNoise (21 Sep 2026), then attributed to CVE-2026-7273: configs, networking information, and hashed root credentials taken from 996 switches in 48 countries from on or about 17 Aug 2026.","sourceUrl":"https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation","sourceDate":"2026-09-21"},{"title":"Recovered GS1900 exploit on a JITTERLY C2 host","detail":"Binarly (3 Nov 2026): gs1900_bundle.tar.gz in an open directory on p2.981666[.]xyz. The team says that exploit targets CVE-2026-107441, including 7273-patched .2 firmware.","sourceUrl":"https://www.binarly.io/blog/zyxel-gs1900-rce-cve-2026-107441","sourceDate":"2026-11-03"}],"evidence":[{"title":"Installed model and firmware from before the upgrade","detail":"Preserve the web-UI model and firmware string so you can show whether the host was below a listed .3 build while reachable.","sources":[{"url":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026","date":"2026-11-03","publisher":"Zyxel"}]},{"title":"DNS, web, and flow logs from 17 Aug 2026","detail":"Keep resolver logs for 981666[.]xyz, GS1900 CGI POST logs, and management-IP flow logs (including TCP 2323) from 17 Aug 2026.","sources":[{"url":"https://www.binarly.io/blog/zyxel-gs1900-rce-cve-2026-107441","date":"2026-11-03","publisher":"Binarly"},{"url":"https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation","date":"2026-09-21","publisher":"GreyNoise"}]}],"limits":["No sourced in-the-wild persistence path on the switch itself.","Binarly's write-up shows the recovered tool can open a new listener (example: TCP 2323). Treat any new listener on a management IP as a lead.","Zyxel has not stated exploitation. Not in CISA KEV for CVE-2026-107441 (checked 4 Nov 2026).","GreyNoise attributed the Aug-Sep thefts to CVE-2026-7273."],"sources":[{"url":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026","date":"2026-11-03","publisher":"Zyxel"},{"url":"https://www.binarly.io/blog/zyxel-gs1900-rce-cve-2026-107441","date":"2026-11-03","publisher":"Binarly"},{"url":"https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation","date":"2026-09-21","publisher":"GreyNoise"}],"updatedAt":"2026-11-04","addedDate":"2026-11-04"},"bulletins":[{"vendor":"Zyxel","title":"Zyxel security advisory for out-of-bounds write in GS1900 series switches","url":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026","date":"2026-11-03","cve":"CVE-2026-107441"},{"vendor":"Zyxel","title":"Zyxel security advisory for stack-based buffer overflow in GS1900 series switches","url":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-stack-based-buffer-overflow-vulnerability-in-gs1900-series-switches-06-16-2026","date":"2026-06-16","cve":"CVE-2026-7273"},{"vendor":"Zyxel Community","title":"Switch GS1900 Series - V2.90 Patch 3 Firmware Release","url":"https://community.zyxel.com/en/discussion/34420/switch-gs1900-series-v2-90-patch-3-firmware-release","date":"2026-10-23","cve":"CVE-2026-107441"},{"vendor":"Binarly","title":"BRLY-2026-057","url":"https://www.binarly.io/advisories/brly-2026-057","date":"2026-11-03","cve":"CVE-2026-107441"}],"coverage":[{"title":"Zyxel security advisory for out-of-bounds write in GS1900 series switches","publisher":"Zyxel","url":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026","date":"2026-11-03","type":"vendor","addedDate":"2026-11-04"},{"title":"BRLY-2026-057","publisher":"Binarly","url":"https://www.binarly.io/advisories/brly-2026-057","date":"2026-11-03","type":"research","addedDate":"2026-11-04"},{"title":"New Zyxel GS1900 pre-auth RCE vulnerability revealed","publisher":"Binarly","url":"https://www.binarly.io/blog/zyxel-gs1900-rce-cve-2026-107441","date":"2026-11-03","type":"research","addedDate":"2026-11-04"},{"title":"Switch GS1900 Series - V2.90 Patch 3 Firmware Release","publisher":"Zyxel Community","url":"https://community.zyxel.com/en/discussion/34420/switch-gs1900-series-v2-90-patch-3-firmware-release","date":"2026-10-23","type":"vendor","addedDate":"2026-11-04"},{"title":"Zyxel security advisory for stack-based buffer overflow in GS1900 series switches","publisher":"Zyxel","url":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-stack-based-buffer-overflow-vulnerability-in-gs1900-series-switches-06-16-2026","date":"2026-06-16","type":"vendor","addedDate":"2026-11-04"},{"title":"Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation","publisher":"GreyNoise","url":"https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation","date":"2026-09-21","type":"research","addedDate":"2026-11-04"},{"title":"Attacker compromised nearly 1000 Zyxel switches since August (CVE-2026-7273)","publisher":"Help Net Security","url":"https://www.helpnetsecurity.com/2026/09/22/zyxel-switches-cve-2026-7273-vulnerability-exploited/","date":"2026-09-22","type":"news","addedDate":"2026-11-04"},{"title":"Zyxel GS1900 Zero-Day CVE-2026-107441 Exploited in the Wild, Bypassing Earlier Patch","publisher":"SecurityOnline","url":"https://securityonline.info/zyxel-gs1900-zero-day-cve-2026-107441/","date":"2026-11-04","type":"news","addedDate":"2026-11-04"},{"title":"CVE-2026-107441 (Zyxel CNA)","publisher":"Zyxel / CVE.org","url":"https://www.cve.org/CVERecord?id=CVE-2026-107441","date":"2026-11-03","type":"vendor","addedDate":"2026-11-04"},{"title":"NVD CVE-2026-107441","publisher":"NIST NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107441","date":"2026-11-03","type":"government","addedDate":"2026-11-04"},{"title":"CISA Known Exploited Vulnerabilities catalog","publisher":"CISA","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-11-03","type":"government","addedDate":"2026-11-04"},{"title":"Red Heron exploits Gitea n-day flaw in multinational campaign, exposing new Linux rootkit","publisher":"Acronis TRU","url":"https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/","date":"2026-09-13","type":"research","addedDate":"2026-11-04"}],"posts":[],"research":[{"title":"New Zyxel GS1900 pre-auth RCE vulnerability revealed","url":"https://www.binarly.io/blog/zyxel-gs1900-rce-cve-2026-107441","authors":"Fernando Mercês, Yegor Vasilenko (Binarly)","date":"2026-11-03T05:22:44.250Z"},{"title":"BRLY-2026-057","url":"https://www.binarly.io/advisories/brly-2026-057","authors":"Binarly REsearch","date":"2026-11-03"},{"title":"Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation","url":"https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation","authors":"Andrew Thompson, Mark Mager (GreyNoise)","date":"2026-09-21"},{"title":"Red Heron exploits Gitea n-day flaw in multinational campaign, exposing new Linux rootkit","url":"https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/","authors":"Acronis TRU","date":"2026-09-13"}],"impact":{"kind":"single-product","product":"Zyxel GS1900 series switches","versions":[{"version":"GS1900-8; 2.90(AAHH.2)C0 and earlier","status":"affected","versions":"2.90(AAHH.3)C0","vendorStatement":{"date":"2026-11-03","url":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026","quote":"The out-of-bounds write vulnerability in the CGI program of the Zyxel GS1900 series switch firmware could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request."},"addedDate":"2026-11-04"},{"version":"GS1900-8HP; 2.90(AAHI.2)C0 and earlier. Community Patch 3 also lists GS1900-8HP Rev. B1 on the same .3 build.","status":"affected","versions":"2.90(AAHI.3)C0","vendorStatement":{"date":"2026-11-03","url":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026","quote":"The out-of-bounds write vulnerability in the CGI program of the Zyxel GS1900 series switch firmware could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request."},"addedDate":"2026-11-04"},{"version":"GS1900-10HP; 2.90(AAZI.2)C0 and earlier","status":"affected","versions":"2.90(AAZI.3)C0","vendorStatement":{"date":"2026-11-03","url":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026","quote":"The out-of-bounds write vulnerability in the CGI program of the Zyxel GS1900 series switch firmware could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request."},"addedDate":"2026-11-04"},{"version":"GS1900-16; 2.90(AAHJ.2)C0 and earlier","status":"affected","versions":"2.90(AAHJ.3)C0","vendorStatement":{"date":"2026-11-03","url":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026","quote":"The out-of-bounds write vulnerability in the CGI program of the Zyxel GS1900 series switch firmware could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request."},"addedDate":"2026-11-04"},{"version":"GS1900-24; 2.90(AAHL.2)C0 and earlier. Binarly: the recovered exploit works on this .2 build.","status":"affected","versions":"2.90(AAHL.3)C0","vendorStatement":{"date":"2026-11-03","url":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026","quote":"The out-of-bounds write vulnerability in the CGI program of the Zyxel GS1900 series switch firmware could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request."},"addedDate":"2026-11-04"},{"version":"GS1900-24E; 2.90(AAHK.2)C0 and earlier","status":"affected","versions":"2.90(AAHK.3)C0","vendorStatement":{"date":"2026-11-03","url":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026","quote":"The out-of-bounds write vulnerability in the CGI program of the Zyxel GS1900 series switch firmware could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request."},"addedDate":"2026-11-04"},{"version":"GS1900-24EP; 2.90(ABTO.2)C0 and earlier","status":"affected","versions":"2.90(ABTO.3)C0","vendorStatement":{"date":"2026-11-03","url":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026","quote":"The out-of-bounds write vulnerability in the CGI program of the Zyxel GS1900 series switch firmware could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request."},"addedDate":"2026-11-04"},{"version":"GS1900-24HPv2; 2.90(ABTP.2)C0 and earlier","status":"affected","versions":"2.90(ABTP.3)C0","vendorStatement":{"date":"2026-11-03","url":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026","quote":"The out-of-bounds write vulnerability in the CGI program of the Zyxel GS1900 series switch firmware could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request."},"addedDate":"2026-11-04"},{"version":"GS1900-48; 2.90(AAHN.2)C0 and earlier","status":"affected","versions":"2.90(AAHN.3)C0","vendorStatement":{"date":"2026-11-03","url":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026","quote":"The out-of-bounds write vulnerability in the CGI program of the Zyxel GS1900 series switch firmware could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request."},"addedDate":"2026-11-04"},{"version":"GS1900-48HPv2; 2.90(ABTQ.2)C0 and earlier","status":"affected","versions":"2.90(ABTQ.3)C0","vendorStatement":{"date":"2026-11-03","url":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026","quote":"The out-of-bounds write vulnerability in the CGI program of the Zyxel GS1900 series switch firmware could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request."},"addedDate":"2026-11-04"}]},"pocs":[],"pocEmptyState":"Binarly (3 Nov 2026) recovered the attacker exploit from a JITTERLY C2 open directory and says it will publish a minimized proof-of-concept later. That planned release is not public as of 4 Nov 2026. No public PoC is indexed. This site does not copy exploit code.","_feed":{"page":"https://vuln2shell.com/vulns/zyxel-gs1900-cve-2026-107441","json":"https://vuln2shell.com/vulns/zyxel-gs1900-cve-2026-107441.json","iocsCsv":"https://vuln2shell.com/vulns/zyxel-gs1900-cve-2026-107441/iocs.csv","stix":"https://vuln2shell.com/vulns/zyxel-gs1900-cve-2026-107441/stix.json","badges":{"patch":"Patched","itw":"Reported exploited","poc":"No public PoC indexed"}}}