Overview
Zyxel has patched a zero-day vulnerability, CVE-2026-107441, in its GS1900 series network switches. Attackers exploited it to compromise nearly 1,000 devices worldwide and steal configuration files and credentials. The flaw is an out-of-bounds write in the web management interface and affects ten GS1900 models.
The bug is a bypass of the earlier fix for CVE-2026-7273, a pre-authentication buffer overflow that Zyxel patched in June 2026 and that CISA added to its Known Exploited Vulnerabilities (KEV) catalog on September 21.
What Happened
Unauthenticated attackers with network access to the management interface could run OS commands by sending crafted HTTP requests. After gaining execution, they downloaded a script that collected:
- Device configurations
- Hashed root credentials
- Network information
GreyNoise reported 996 compromised devices across 48 countries, with activity starting around August 17. It linked the activity to a suspected Chinese-speaking actor tracked as Kapibala, which it connected to the Red Heron campaign.
Why the June Patch Failed
The exploit corrupts a parameter counter before it is validated, which sidesteps the June fix. Binarly found the exploit still worked against all ten firmware releases that were patched for CVE-2026-7273. The new fix limits parameter sizes and validates the parameter count before data is copied into memory.
Timeline
| Date | Event |
|---|---|
| Aug 17 (approx.) | Exploitation begins, per GreyNoise |
| Sep 21 | GreyNoise discloses the campaign and attributes it to CVE-2026-7273 |
| Sep 28 | Binarly confirms the exploit works against patched firmware |
| Sep 29 | Binarly reports the findings to Zyxel |
| Oct 11 | Zyxel confirms the new vulnerability |
| Oct 22 | Zyxel releases fixed firmware |
| Nov 3 | Zyxel publishes its advisory |
Recommended Actions
- Install the latest GS1900 firmware from Zyxel for every affected model. Being on the June patch level is not enough.
- Restrict management access. Keep the web interface off untrusted networks and the internet, and limit it to a dedicated management VLAN.
- Treat exposed switches as compromised. Rotate admin and root credentials and any secrets stored in switch configurations, such as SNMP strings and RADIUS keys.
- Review switch configs and logs for unexpected changes or outbound connections.
Sources
- BleepingComputer: Zyxel fixes zero-day exploited to hack nearly 1,000 network switches
- GreyNoise and Binarly research, as cited above