Zyxel switch hacks blamed on patched flaw actually used a zero-day, Binarly says
Binarly says the attacks GreyNoise pinned on a June-patched Zyxel bug instead exploited a separate out-of-bounds write, which Zyxel fixed in October.
The Zyxel GS1900 switch compromises that GreyNoise attributed to a bug patched in June were carried out with a different, then-unknown vulnerability, according to Binarly. SecurityWeek reported the finding on November 5.
GreyNoise said on September 21 that attackers used CVE-2026-7273, a Zyxel flaw patched in June, to compromise roughly 1,000 devices in August, and linked the activity to a Chinese threat actor it calls Red Heron. CISA added that CVE to its KEV catalog.
Binarly now says the exploit targeted a previously unknown flaw, tracked as CVE-2026-107441, an out-of-bounds write in the CGI program of the GS1900 firmware. Zyxel rates it 8.8 and says an unauthenticated attacker could use crafted HTTP requests to run OS commands. It affects 10 GS1900 models. Zyxel shipped fixes on October 23 and published an advisory on November 3.
The attackers deployed variants of the Jitterly and Sixzut malware that Acronis analysed. Binarly notes the CVE-2026-7273 patch did nothing to stop them, and says advisories and version numbers can't be taken at face value.
Binarly told Zyxel on September 29; the vendor confirmed the new bug two weeks later. Nobody has published how many devices the zero-day itself hit.
If you run GS1900 switches, check the firmware build against the November 3 advisory rather than assuming the June update covered you.
CVE references
Sources
- Zyxel Switch Hacks Blamed on Patched Flaw Actually Exploited a Zero-DayPrimarywww.securityweek.com
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning