CompTIAAvailable
N10-009
Zyxel Fixes Zero-Day Exploited to Hack Nearly 1,000 Switches
Zyxel patched a zero-day in its GS1900 series switches that attackers used to compromise nearly 1,000 devices. Update the firmware, restrict the web interface, and rotate credentials.
Short answer: Zyxel fixed CVE-2026-107441, an unauthenticated out-of-bounds write in the web interface of ten GS1900 switch models. It was exploited in the wild, and it bypassed the earlier June patch for CVE-2026-7273. Install the firmware Zyxel released on October 22, limit access to the management interface, and rotate credentials.
Zyxel has patched a zero-day in its GS1900 series switches that attackers used to compromise nearly 1,000 devices. The flaw is tracked as CVE-2026-107441, and you should install the October 22 firmware now. BleepingComputer reported the story on November 4, 2026.
What happened: a patched bug that was not fully patched
CVE-2026-107441 is an out-of-bounds write in the switches' web management interface. An unauthenticated attacker with network access can send specially crafted HTTP requests and run operating system commands.
The story began earlier. On June 16, 2026, Zyxel fixed CVE-2026-7273, a pre-authentication buffer overflow in the same switches. Starting around August 17, GreyNoise saw a suspected Chinese-speaking actor, tracked as Kapibala, exploiting Zyxel switches. GreyNoise reported 996 compromised devices across 48 countries.
The attackers ran commands remotely, then downloaded a script. That script collected device configurations, hashed root credentials, and network information.
When GreyNoise disclosed the campaign on September 21, it blamed CVE-2026-7273. CISA added that CVE to its Known Exploited Vulnerabilities catalog the same day.
Binarly then found the exploit actually targeted a separate, unknown bug. It found an obfuscated Python exploit in an exposed archive on Red Heron infrastructure. That campaign is linked to the JITTERLY backdoor and SIXZUT rootkit.
Who is affected
The flaw affects ten GS1900 switch models. That includes switches already updated for CVE-2026-7273. Binarly confirmed on September 28 that the exploit still worked against all ten firmware releases from the June fix.
The earlier update added checks against a buffer overflow. Attackers got around them by corrupting a parameter counter before it was validated.
Item | CVE-2026-7273 | CVE-2026-107441 |
|---|---|---|
Type | Pre-auth buffer overflow | Out-of-bounds write, missing HTTP parameter length validation |
Fix released | June 16, 2026 | October 22, 2026 |
Advisory | June 2026 update | Published November 3 |
Still exploitable after the June update? | Fixed, but bypassed | Yes, until the October 22 firmware |
If your GS1900 runs firmware from before October 22, treat it as exposed. Check Zyxel's advisory for the exact model list and firmware numbers.
How serious it is
This is serious because it is exploited, needs no login, and gives command execution. It is a zero-day that was abused before a fix existed.
The damage goes beyond one switch. Stolen configuration files and credential hashes can help attackers move deeper into a network. A switch is also rarely monitored like a server, so a compromise can sit unnoticed.
One point is still open: it is unclear whether the exploit was built to bypass the June updates or hit a related flaw those patches missed. Zyxel's advisory and Binarly's research are the places to check for updates.
What to do now
Update firmware. Install the GS1900 firmware Zyxel released on October 22 or later. It limits parameter sizes and validates the parameter count before copying data into memory.
Restrict the web interface. Allow management access only from a dedicated management VLAN or a jump host. Never expose it to the internet.
Rotate credentials. The attack script collected hashed root credentials, so change admin passwords on any switch that was reachable. Reuse of those passwords elsewhere also needs fixing.
Compare configurations. Look for changes you did not make.
Find switches with an open web interface
Run this from a management host to list devices answering on the web ports:
nmap -p 80,443 --open -sV 10.0.0.0/24Run this from outside your network against your public addresses. Any hit on a switch is a problem:
nmap -Pn -p 80,443 --open YOUR_PUBLIC_IP_RANGEConfirm a specific device is a switch you manage:
curl -skI https://SWITCH_IP/ | head -n 5Check for unexpected changes
Export the running configuration from the switch's web interface, then compare it to your last known good backup:
diff -u last-known-good.cfg current.cfgWorked example
Say a small office has three GS1900 switches. Two sit on the management VLAN, and one has a web interface reachable from the guest network.
Start with the exposed one. Update it, block guest access to it, and rotate its password. Then update the other two.
Check the configs for unknown accounts or changed settings. If the exposed switch looks altered, assume its credentials leaked and change them anywhere they were reused.
What IT and security learners can take from this
This case shows why a patch is not the same as a fix. The June update added checks, and attackers still bypassed them. Defenders need patch verification, network segmentation, and management-plane isolation, not only fast updates.
Those topics appear in networking and security study paths. The CompTIA Network+ N10-009 voucher covers switching, device hardening, and network security basics. For another recent case of chained zero-days in edge devices, read our Ivanti Connect Secure zero-days write-up, or browse the cybersecurity certifications page.
Sources: BleepingComputer, which cites Zyxel, GreyNoise, Binarly, and CISA.
Sources
Questions about this topic
Is my switch safe if I installed the June 2026 update?
Not necessarily. Binarly confirmed the exploit worked against all ten firmware releases that fixed CVE-2026-7273. You need the newer firmware Zyxel released on October 22.
Does an attacker need a password to exploit CVE-2026-107441?
No. The flaw lets an unauthenticated attacker with network access send crafted HTTP requests and run operating system commands. Limiting who can reach the web interface reduces the risk.
What data did the attackers take?
The downloaded script collected device configurations, hashed root credentials, and network information. Rotate credentials on affected switches and review configurations for unexpected changes.
Who is behind the attacks?
GreyNoise tracks a suspected Chinese-speaking threat actor called Kapibala. It linked the activity to the Red Heron campaign, which Acronis previously tied to exploitation of a critical Gitea vulnerability.
Why did Zyxel assign a new CVE instead of reusing the old one?
Zyxel treated it as a separate flaw because the exploit also abused missing validation of HTTP parameter lengths. It confirmed the new vulnerability on October 11 and assigned CVE-2026-107441.
