Zyxel patches zero-day exploited to hack nearly 1,000 network switches

Zyxel has released security updates for a zero-day vulnerability in its GS1900 series network switches that hackers exploited to compromise nearly 1,000 devices worldwide and steal configuration files and credentials. The flaw, tracked as CVE-2026-107441, is an out-of-bounds write issue in the switches' web management interface. It allows an unauthenticated attacker with network access to execute operating system commands using specially crafted HTTP requests. Ten GS1900 switch models are affected. Zyxel shipped fixes on October 22 and published a security advisory on November 3. The vulnerability was initially mistaken for an older bug that Zyxel had already patched months before the attacks began. On June 16, 2026, the vendor released updates addressing CVE-2026-7273, a pre-authentication buffer overflow affecting the same switches. Starting around August 17, cybersecurity company GreyNoise observed a suspected Chinese-speaking threat actor tracked as Kapibala exploiting Zyxel switches, reporting that 996 devices across 48 countries were compromised. The attackers executed commands remotely and then downloaded a script that collected device configurations, hashed root credentials, and network information. GreyNoise linked Kapibala to the Red Heron hacking campaign, which Acronis previously reported was exploiting a critical vulnerability in the self-hosted Git service Gitea. When GreyNoise disclosed the switch campaign on September 21, it attributed the exploitation to CVE-2026-7273. CISA added that flaw to its Known Exploited Vulnerabilities catalog the same day, requiring federal agencies to address it. Researchers at firmware security company Binarly later found that the exploit used in the attacks actually targeted a separate, previously unknown vulnerability that remained unpatched. While investigating Red Heron infrastructure linked to the JITTERLY backdoor and SIXZUT rootkit, the researchers discovered an exposed archive containing an obfuscated Python exploit targeting GS1900 switches. Analysis showed the exploit specifically checked for firmware versions patched for CVE-2026-7273, indicating it had been developed or updated to target those releases. Binarly confirmed on September 28 that the exploit remained effective against all ten firmware versions fixed for the June vulnerability. The researchers determined that the earlier update added checks to prevent a buffer overflow, but attackers could bypass them by corrupting a parameter counter before it was validated. This allowed the exploit to overwrite memory and execute commands without authentication, even on switches running the June patches. Binarly reported its findings to Zyxel on September 29, and the vendor confirmed the new vulnerability on October 11, assigning it CVE-2026-107441. Zyxel classified it as a separate flaw because the exploit also abused missing validation of HTTP parameter lengths. The October 22 firmware limits parameter sizes and validates the parameter count before copying data into memory, blocking the exploitation technique. It remains unclear whether the exploit was deliberately developed to bypass the June updates or abused a related vulnerability that those patches failed to address. Administrators of affected GS1900 switches are advised to install the latest firmware to protect against CVE-2026-107441.