Zyxel has patched a previously unknown zero-day vulnerability in its GS1900 series network switches after attackers exploited it to compromise approximately 1,000 devices worldwide and steal configuration files, credentials and network information. Tracked as CVE-2026-107441, the flaw allows unauthenticated attackers with network access to execute operating system commands through a specially crafted HTTP request.
The vulnerability is an out-of-bounds write in the switches’ web management interface. It affects 10 GS1900 models, and Zyxel released a firmware update on October 22. The company published a security advisory on November 3.
Attackers targeted Zyxel switches with a second flaw
The vulnerability was initially misunderstood as an older issue that Zyxel had already fixed months before the attacks began.
On June 16, 2026, Zyxel released a security update for CVE-2026-7273, a pre-authentication buffer overflow affecting the same GS1900 switch series.
Cybersecurity company GreyNoise observed a suspected Chinese-speaking attacker known as Kapibala exploiting Zyxel switches from around August 17. The company said the attackers compromised 996 devices in 48 countries.
The attackers used the flaw to execute commands remotely before downloading a script that collected device configurations, hashed root credentials and network information.
GreyNoise has linked Kapibala to the Red Heron hacking campaign. Acronis previously reported that Red Heron was exploiting a critical vulnerability in the self-hosted Gitea Git service.
When GreyNoise disclosed the campaign on September 21, it attributed the attacks to CVE-2026-7273, the vulnerability Zyxel had patched in June. That same day, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-7273 to its catalog of known exploited vulnerabilities and required federal agencies to address it.
Binarly identifies the unpatched vulnerability
Researchers at firmware security company Binarly later discovered evidence in the firmware that the attacks targeted a different, previously unknown vulnerability.
While investigating infrastructure associated with the JITTERLY backdoor and SIXZUT rootkit, Binarly researchers found a publicly accessible archive containing an obfuscated Python exploit for Zyxel GS1900 switches.
Analysis showed that the exploit checked for firmware versions patched against CVE-2026-7273, suggesting it had been developed or updated to target those versions. Binarly confirmed on September 28 that the exploit remained effective against all 10 firmware releases that addressed CVE-2026-7273.
According to the researchers, the earlier updates added checks intended to prevent buffer overflows. However, an attacker could potentially bypass those checks by manipulating parameter counters before they were validated. This could allow the attacker to overwrite memory and execute commands without authentication, even on switches that had received the previous security updates.
Binarly reported the findings to Zyxel on September 29. Zyxel confirmed the new vulnerability on October 11 and assigned it CVE-2026-107441.
Zyxel releases a new firmware update
Zyxel classified CVE-2026-107441 as a separate vulnerability because the exploit also took advantage of missing HTTP parameter-length validation.
The October 22 firmware update limits parameter sizes and validates the number of parameters before copying data into memory, blocking the exploitation techniques identified by researchers.
The recovered exploit specifically targeted firmware patched for CVE-2026-7273. However, it remains unclear whether it was deliberately designed to bypass those updates or exploited a related weakness that the earlier patch did not address.
Administrators responsible for affected Zyxel GS1900 switches should install the latest available firmware update to protect against CVE-2026-107441.
Source: www.bleepingcomputer.com