# Zyxel GS1900 CVE-2026-107441 threat-hunting pack

Out-of-bounds write in the CGI program of Zyxel GS1900 series switch firmware. Per Zyxel, it "could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request." Firmware patched only for CVE-2026-7273 (June 2026) is still vulnerable.

**Status of this pack:** the KQL has NOT been run against a live tenant. Syntax was reviewed only. Sigma rules pass `sigma check`. Checkers are tested offline against fixtures.

## Verified facts (checked 4 Nov 2026)

| Item | Value | Source |
|---|---|---|
| CVE-2026-107441 | Out-of-bounds write (CWE-787), CGI program, unauthenticated, LAN-based / adjacent | Zyxel advisory 2026-11-03; cve.org record |
| CVSS | 3.1 base **8.8 HIGH**, `CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, scored by **Zyxel (CNA)** | cve.org; NVD shows the same CNA score |
| NVD | Status "Awaiting Analysis"; no NVD primary score | NVD |
| CISA ADP SSVC | Exploitation: none, Automatable: no, Technical Impact: total (2026-11-04) | cve.org ADP container |
| CVE dates | Reserved 2026-10-08, published 2026-11-03 | cve.org |
| Zyxel advisory | Published 2026-11-03 (initial release) | Zyxel |
| Fixed firmware | V2.90 Patch 3 posted on Zyxel Community 23 Oct 2026 (news says released 22 Oct) | Zyxel Community firmware post |
| KEV CVE-2026-107441 | **Not listed** | KEV JSON, catalog 2026.11.04 (released 2026-11-04T20:00:05Z, 1768 entries) |
| KEV CVE-2026-7273 | **Listed**: added 2026-09-21, due 2026-09-24, knownRansomwareCampaignUse Unknown, forensicTriage Yes, CWE-121, requiredAction per BOD 26-04 | KEV JSON, catalog 2026.11.04 |
| CVE-2026-7273 | Stack-based buffer overflow, CGI program, CNA CVSS 8.8 HIGH (same vector), published 2026-06-16, NVD Analyzed | Zyxel advisory 2026-06-16; cve.org; NVD |

### Affected models and fixed firmware

| Model | CVE-2026-7273 fixed in | CVE-2026-107441 affected | CVE-2026-107441 fixed in |
|---|---|---|---|
| GS1900-8 | 2.90(AAHH.2)C0 | 2.90(AAHH.2)C0 and earlier | 2.90(AAHH.3)C0 |
| GS1900-8HP (incl. Rev. B1) | 2.90(AAHI.2)C0 | 2.90(AAHI.2)C0 and earlier | 2.90(AAHI.3)C0 |
| GS1900-10HP | 2.90(AAZI.2)C0 | 2.90(AAZI.2)C0 and earlier | 2.90(AAZI.3)C0 |
| GS1900-16 | 2.90(AAHJ.2)C0 | 2.90(AAHJ.2)C0 and earlier | 2.90(AAHJ.3)C0 |
| GS1900-24 | 2.90(AAHL.2)C0 | 2.90(AAHL.2)C0 and earlier | 2.90(AAHL.3)C0 |
| GS1900-24E | 2.90(AAHK.2)C0 | 2.90(AAHK.2)C0 and earlier | 2.90(AAHK.3)C0 |
| GS1900-24EP | 2.90(ABTO.2)C0 | 2.90(ABTO.2)C0 and earlier | 2.90(ABTO.3)C0 |
| GS1900-24HPv2 | 2.90(ABTP.2)C0 | 2.90(ABTP.2)C0 and earlier | 2.90(ABTP.3)C0 |
| GS1900-48 | 2.90(AAHN.2)C0 | 2.90(AAHN.2)C0 and earlier | 2.90(AAHN.3)C0 |
| GS1900-48HPv2 | 2.90(ABTQ.2)C0 | 2.90(ABTQ.2)C0 and earlier | 2.90(ABTQ.3)C0 |

Zyxel: "on-market products not listed in the table remain unaffected"; patches cover models "still within their vulnerability support period". End-of-support GS1900 models (for example GS1900-24HP v1, GS1900-48HP v1) are not covered; the checkers report them UNKNOWN. Note the cve.org record names "GS1900-HPv2 firmware" for ABTP, which the Zyxel table lists as GS1900-24HPv2.

## KEV and what to do

CVE-2026-7273 is in CISA KEV with a due date of 2026-09-24. That due date applies to US federal agencies only (BOD 26-04). CVE-2026-107441 is not in KEV (catalog 2026.11.04). **Patch now regardless**: install 2.90(XXXX.3)C0 for your model. A switch on a .2 build (the CVE-2026-7273 fix) is NOT safe.

1. Upgrade every listed model to its .3 build.
2. Keep the web UI on a dedicated management VLAN; block it from user, guest and internet networks.
3. On any switch whose web UI was reachable from outside the management network: rotate admin and all local account passwords, SNMP communities, RADIUS/TACACS+ shared secrets and any other secrets in the config, and review the config for changes. News reports say attackers stole configurations and hashed root credentials.
4. Run the hunts below over at least the period since mid-August 2026.

## IOCs

**Primary sources (Zyxel, CISA, NVD, cve.org) publish no IOCs. This pack contains none.**

Unverified, news-reported only: the news article names no IP addresses, domains or hashes. It describes behaviour only (remote command execution, then a downloaded script collecting device configurations, hashed root credentials and network information). Treat as unverified.

## Contents

| Path | What |
|---|---|
| `kql/zyxel-gs1900-hunting.kql` | Q1a/Q1b internet to management ports (CommonSecurityLog, DeviceNetworkEvents), Q2 switch new outbound, Q3 Syslog config/login/reboot (keywords UNVERIFIED), Q4 internal hosts reaching web UIs, Q5 inventory |
| `sigma/*.yml` | 6 rules mirroring Q1 to Q4; `sigma/converted/kusto_no_pipeline.txt` has the Kusto output |
| `scripts/check-zyxel-gs1900.sh`, `scripts/Check-ZyxelGS1900.ps1` | Offline firmware checkers |
| `tests/` | bash and Pester tests, fixtures, `run_all.sh` |

Placeholders: `192.0.2.20`, `192.0.2.21` (switch management IPs), ports 80/443, `10.99.0.0/24` (management subnet). Field names for Syslog content are UNVERIFIED because Zyxel does not document GS1900 syslog text for this issue.

**Sigma:** `sigma check` passes (0 errors, 0 issues). `sigma convert -t kusto --without-pipeline` works for all 6 rules. The `azure_monitor`, `sentinel_asim` and `microsoft_xdr` pipelines fail for all 6 because there is no table mapping for `product: zyxel` or `category: firewall`; add the table (CommonSecurityLog / Syslog) yourself.

## Checkers

Strictly **read-only and offline**: they only compare strings you supply, or read a CSV, saved config or exported syslog file you give them. They never contact a switch, send no network traffic, contain no payloads and write no files.

```
scripts/check-zyxel-gs1900.sh --model GS1900-24 --firmware '2.90(AAHL.2)C0'
scripts/check-zyxel-gs1900.sh --csv inventory.csv          # header: name,model,firmware
scripts/check-zyxel-gs1900.sh --config saved-config.cfg    # reads model/firmware strings if present
scripts/check-zyxel-gs1900.sh --csv inventory.csv --syslog exported.log
pwsh scripts/Check-ZyxelGS1900.ps1 -Csv inventory.csv -Syslog exported.log
```

Verdicts: **PATCHED** (.3 or later, or a newer major version), **LIKELY VULNERABLE** (.2 builds are flagged `7273-ONLY`: patched for CVE-2026-7273 but not CVE-2026-107441; .1 and older are vulnerable to both), **UNKNOWN** (model not in Zyxel's table, firmware code does not match the model, or no version parsed). Exit codes: 0 all PATCHED, 1 any LIKELY VULNERABLE, 2 any UNKNOWN, 3 error. Saved-config and syslog formats are UNVERIFIED; the checker only looks for strings like `GS1900-24` and `2.90(AAHL.3)C0`.

Run all tests: `bash tests/run_all.sh` (shellcheck, PSScriptAnalyzer, bash tests, Pester, bwrap sandbox with no network and read-only filesystem, sigma check).

## Sources

- Zyxel, CVE-2026-107441 advisory: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026
- Zyxel, CVE-2026-7273 advisory: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-stack-based-buffer-overflow-vulnerability-in-gs1900-series-switches-06-16-2026
- Zyxel Community, V2.90 Patch 3 firmware: https://community.zyxel.com/en/discussion/34420/switch-gs1900-series-v2-90-patch-3-firmware-release
- cve.org: https://www.cve.org/CVERecord?id=CVE-2026-107441 and https://www.cve.org/CVERecord?id=CVE-2026-7273
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-107441 and https://nvd.nist.gov/vuln/detail/CVE-2026-7273
- CISA KEV JSON: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
- CISA BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- MITRE CWE-787: https://cwe.mitre.org/data/definitions/787.html