What happened
Zyxel released a fix for CVE‑2026‑107441 on October 22 2026, but Binarly’s testing confirmed that the exploit still achieves unauthenticated command execution on all firmware releases that already included the June 2026 patch for CVE‑2026‑7273. The exploit targets the `/cgi-bin/dispatcher.cgi` CGI endpoint, runs via a crafted HTTP request, and has been used to steal configuration data and hashed root credentials from nearly 1,000 devices across 48 countries. The exploit script is publicly available and appears to be LLM‑generated.
Why it matters for trust and compliance
- The story underscores the control objective of ensuring that vulnerability remediation truly mitigates the identified risk, not just that a patch was applied.
- Demonstrates the need for continuous verification of patch effectiveness as audit evidence.
- Supports mapping of vulnerability‑remediation controls across multiple frameworks (e.g., NIST CSF, ISO 27001).
Who is affected
TECH_SAAS
Recommended actions
- Inventory all Zyxel GS1900 devices and record firmware versions.
- Run an independent verification test for CVE‑2026‑107441.
- Upgrade to the latest Zyxel firmware that fully mitigates the flaw.
- Integrate continuous patch‑validation into your vulnerability‑management process.
Details
- CVEs
- CVE-2026-107441, CVE-2026-7273