You applied the switch patch and stayed exposed for 128 days

On 22 September we wrote here that the patch for your switch had been out 97 days. That was true and the arithmetic was right. What we did not know — and what has been known since 3 November — is that the patch left inside an overflow that lets anyone run commands as root without authenticating. Anyone who installed it on day one stayed exposed until 22 October: another 128 days.

This is a story about people who did patch, and the reason it made no difference fits in one line of pseudocode: the June fix counted the parameters after copying them.

What was fixed in June and what was not

The CGI program on these switches stores the parameters of each HTTP request in a global object called reqParameters. It holds 140 slots of 1,024 bytes — the advisory states 143,364 bytes reserved in total; 140 × 1,024 is 143,360 — and, sitting immediately behind it in the same .bss segment, the counter tracking how many slots have been used: g_count. The counter lives right behind the array, with nothing in between.

Send a 140th parameter longer than its slot and the copy runs off the end of the array and lands on the counter. From there the next parameter gets written wherever you say, and that includes the program's own function-pointer table. Operating system commands, as root, with no authentication.

What Zyxel added in June, according to the binary diff Binarly published, was two checks: increment the counter and bail out if it reaches 140, and clamp it back to 140 if it reaches 141. A correct bounds check, placed in the wrong spot. Binarly's own sentence is drier than any paraphrase: "This change does not address the vulnerability. An unbounded copy into entry 139 occurs prior to the check. This means that the g_count value can be overwritten before it can be checked."

The ten firmware archives published in June, one per model, contain exactly the same binary. Binarly lists the SHA-256 of the .bix payload and of each of the seven CGI programs, and it is identical across all ten. They were ten downloads of the same code. Their conclusion, verbatim: "In either case, the vulnerability described in the current advisory is present in all ten of the firmware releases that were advertised as fixes."

All three sources sending you to patch described a different flaw

Here is the part that actually matters to anyone running a fleet, and it has little to do with Zyxel: it is about how you decide what to spend Tuesday on. If in September you were prioritising by the three usual signals, all three pointed at the wrong place.

The middle row is the most interesting and the least comfortable, because both scores can be right at the same time. The gap between 8.8 and 9.8 here is not technical, it is topological: Binarly says exploitation goes over HTTP with no protocol-level adjacency requirement, that all it takes is "network reachability to the management service". If your switches' web interface lives only on an isolated management VLAN, the 8.8 describes your case. If it sits on the same network as your users, the 9.8 describes it. We made the same point about another vendor: your configuration decides it, not the score.

And on the third row, a check we ran today rather than take anyone's word: we downloaded the full KEV catalogue (version 2026.11.04, 1,768 entries) and looked. CVE-2026-7273 is there, since 21 September. CVE-2026-107441, the flaw the June firmware left inside and the one the captured exploit implements, is not. As of today, anyone driving their patching from the catalogue has no open task for that overflow.

The timeline, which is the hardest document here

Two gaps in that table are worth a whole conversation. The first: between 22 October, when the good firmware appears, and 3 November, when anyone explains why you need it, there are 12 days. Twelve days in which the fix sat on the vendor's community forum as a "Patch 3" release — one release note among others — with no security advisory to give it urgency. If your process waits for the advisory before moving, you were twelve days late even doing everything right.

The second: we published on 22 September and Binarly closed its verification on the 28th. Six days. We had no way of knowing and we invented nothing — everything we wrote then came from the official records — but the frame was wrong: we counted the days the patch had been available as though installing it closed the matter. The number was right; the conclusion it invited was not.

What they took, no firmware gives back

This is the part that gets lost in headlines about patches. GreyNoise documented what left those 996 switches across 48 countries: the configurations, the root credentials (hashed) and the networking information. The floor plan of the building. VLANs, addressing, names, what talks to what.

And one figure from the same report worth reading twice: 564 of the victims had factory default credentials. More than half. The flaw needed no password to get in — it is pre-authentication — so those 564 did not fall because of it; but when you exfiltrate the configuration of a device still carrying its factory password, what you get is a key that remains valid after the firmware is updated. Updating closes the door. It does not invalidate the credentials that already left, nor make the attacker forget your topology.

We have written about this class of device before, in the switch that belongs to nobody: you buy it once, rack it, it runs for eight years and never shows up in a patching inventory. The difference here is that nobody would have found out from the inside. An access switch carries no agent, has no EDR and will not call you. What is left is stored telemetry and somebody to look at it — the argument for managed detection and response — and that is exactly the problem we covered when we wrote that the advisory came 47 days late and your logs last 30.

Before this gets retold badly

Four caveats, because the exaggerated version of this post would be false and would travel better.

Six things, and only one of them is patching

Only the first item is "patch". The other five are the ones that change anything, and none of them expire with the next advisory.

Items 2 and 5 are the work of managed networks and communications and no bulletin does them for you: you do them once, with the network in front of you. Item 6 is IT maintenance in a sentence. And segmenting the management plane is what turns the next flaw of this kind — and there will be one, from another vendor, in another CGI — into an advisory you read calmly instead of in one afternoon.

The lesson we are taking from this is not about Zyxel, nor about a badly placed counter. It is that "we are up to date" does not describe a security state: it describes a version number matching the one a vendor said was fine.

Sources. Consulted on 5 November 2026. The technical analysis — the web_util_initParaPairs function, the global reqParameters object with 140 entries of 1,024 bytes and g_count immediately behind it in .bss, the diff of the lines added in June, both verbatim quotes, the identical SHA-256 of the .bix payload across all ten archives, the AV:N / 9.8 assessment and the disclosure timeline — comes from Binarly advisory BRLY-2026-057, published on 3 November 2026. The two official records, assigned by Zyxel as CNA, through the CVE Program API: CVE-2026-7273 (published 16-06-2026, CWE-121, CVSS 3.1 8.8 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and CVE-2026-107441 (published 03-11-2026 at 01:41 UTC, CWE-787, same CVSS and same vector). The ten models and the move from .2)C0 to .3)C0, the single-line revision history ("2026-11-3: Initial release"), the credit to Yegor Vasilenko and Fernando Mercês of Binarly, and the absence of any mention of active exploitation or credential rotation come from Zyxel's 3 November advisory. The 996 switches across 48 countries, the "on or about 17 August" date, what was exfiltrated (configurations, hashed root credentials and networking information) and the 564 victims with factory default credentials come from GreyNoise's report "Open Season on Kapibala", dated 21 September 2026, which attributes the activity to an actor it calls Kapibala and places it as "the same or related to" the Red Heron campaign. The addition of CVE-2026-7273 to the KEV catalogue on 21-09-2026 with a federal due date of the 24th, and the absence of CVE-2026-107441 from that catalogue, we checked ourselves by downloading the full KEV JSON (version 2026.11.04, 1,768 entries, released 04-11-2026 at 20:00 UTC). The day counts (128 from June to October, 140 from advisory to advisory, 12 from firmware to advisory, 6 from our post to Binarly's verification) are ours, computed over those dates. The use of NetBox as a source of truth and the criterion on management-plane segmentation come from our own managed networking work, and are not backed by those sources.