Zyxel patches GS1900 zero-day that bypassed its June fix
Attackers compromised nearly 1,000 switches across 48 countries before the flaw was identified as a separate bug from the one CISA flagged in September.
Key facts
- Affected
- 996 devices
Zyxel has patched a zero-day in its GS1900 series switches that attackers used to compromise nearly 1,000 devices worldwide and steal configuration files and credentials. The flaw, CVE-2026-107441, is an out-of-bounds write in the switches' web management interface. An unauthenticated attacker with network access can run OS commands through crafted HTTP requests. Ten GS1900 models are affected. Zyxel shipped firmware on October 22 and published an advisory on November 3.
The awkward part is the timeline. Zyxel fixed a pre-authentication buffer overflow, CVE-2026-7273, on June 16. From around August 17, GreyNoise watched a suspected Chinese-speaking actor it tracks as Kapibala hit Zyxel switches, counting 996 devices in 48 countries. The actor ran commands, then pulled a script that collected device configurations, hashed root credentials and network information. GreyNoise linked Kapibala to the Red Heron campaign, which Acronis had tied to exploitation of a Gitea flaw.
When GreyNoise published on September 21, it blamed CVE-2026-7273, and CISA added that CVE to its Known Exploited Vulnerabilities catalog the same day. Binarly then found an exposed archive on Red Heron infrastructure holding an obfuscated Python exploit that checked for firmware patched against the June bug, and confirmed on September 28 that it still worked against all ten patched releases. The June update added checks against the overflow, but corrupting a parameter counter before validation got around them. Zyxel confirmed the new flaw on October 11.
Nobody has said whether the exploit was built to bypass the June patches on purpose or just landed on a gap they missed. Either way, anyone who applied the June firmware and stopped there is still exposed. Check the build string on every GS1900 in the estate against the October firmware.
CVE references
Sources
- Zyxel fixes zero-day exploited to hack nearly 1,000 network switchesPrimarywww.bleepingcomputer.com
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning