CompTIAAvailable
N10-009
Zyxel Switch Hacks Blamed on Patched Flaw Were a Zero-Day
Binarly says the Zyxel GS1900 attacks blamed on an older patched bug really used a zero-day, CVE-2026-107441. Here is what to check and fix.
Short answer: Binarly reports that attacks on nearly 1,000 Zyxel GS1900 switches used a previously unknown flaw, CVE-2026-107441 (CVSS 8.8), not the earlier patched CVE-2026-7273. Zyxel released fixes on October 23 and published an advisory on November 3. Update affected GS1900 switches and make sure their web interface is not reachable from the internet.
What happened: the patched bug was not the one being exploited
A Zyxel GS1900 switch flaw was exploited as a zero-day to hack almost 1,000 devices, according to security firm Binarly. Earlier reports blamed a different, already patched bug. That blame was wrong, so patching for the old bug did not protect devices from this threat actor. SecurityWeek has the full report.
The new flaw is tracked as CVE-2026-107441. It is an out-of-bounds write in the CGI program of the GS1900 series switch firmware. An unauthenticated attacker can send crafted HTTP requests and run OS commands on the switch.
How the story changed
GreyNoise first warned on September 21 that attackers had used CVE-2026-7273, a Zyxel bug patched in June. It said roughly 1,000 devices were compromised in August. GreyNoise linked the attacks to Red Heron, a Chinese threat actor, and CISA added CVE-2026-7273 to its KEV catalog.
Binarly now says the attackers did not use that bug. They deployed variants of the Jitterly and Sixzut malware, the same malware families Acronis analyzed, which is why investigators pointed to Red Heron. But their exploit targeted a previously unknown vulnerability. Binarly put it this way: because the actor was exploiting a different vulnerability, the CVE-2026-7273 patch "had no effect on protecting devices" from being exploited by this threat actor.
Date | Event |
|---|---|
June | Zyxel patches CVE-2026-7273 |
August | Roughly 1,000 devices compromised, per GreyNoise |
September 21 | GreyNoise blames CVE-2026-7273 |
September 29 | Binarly notifies Zyxel of the new flaw |
Mid-October | Zyxel confirms CVE-2026-107441, about two weeks later |
October 23 | Zyxel rolls out fixes |
November 3 | Zyxel publishes its advisory; Binarly publishes its warning |
Who is affected
The flaw impacts 10 GS1900 switch models. If you run any Zyxel GS1900 series switch, treat it as in scope until you have checked it against the Zyxel advisory. The model-by-model list and fixed firmware versions are in the advisory Zyxel published on November 3.
This also affects you if you only patched for CVE-2026-7273 in June. That update did not close this hole.
How serious it is
The CVSS score is 8.8. Three things make it worse than the number suggests:
No login is needed.
The attack is plain HTTP requests to the switch's web interface.
Attackers already used it in the wild before a fix existed.
A compromised switch sits in the middle of your network. Attackers can use it to watch traffic or as a foothold for further access. The malware families named in the report, Jitterly and Sixzut, are the ones to look for in any threat intelligence feed you use.
What to do now
Work through this list in order.
Find every GS1900. Check your asset inventory, then scan for switch web interfaces.
Update the firmware to the fixed release listed in the Zyxel advisory. Zyxel released fixes on October 23.
Remove internet exposure. The web management interface should only be reachable from a management VLAN or a VPN.
Restrict who can reach it. Allow only your admin hosts to connect on ports 80 and 443.
Hunt for signs of compromise using your firewall and syslog data.
Scan your internal ranges for web management interfaces (change the range to match yours):
nmap -p 80,443 --open -sV 10.0.0.0/24From a machine outside your network, test whether a switch answers on your public address:
nmap -Pn -p 80,443 YOUR_PUBLIC_IPCheck what a suspect switch returns on its web port:
curl -skI https://SWITCH_IP/ | head -n 5If you log traffic, look for hosts other than your admins talking to the switch, and for the switch making outbound connections it should never make. This command matches lines that mention the switch and drops lines where an admin host is the source or destination. Field names like src= and dst= depend on your firewall log format, so adjust them and the file name:
grep "SWITCH_IP" /var/log/firewall.log | grep -v -e "src=ADMIN_IP" -e "dst=ADMIN_IP"A switch that makes outbound connections to the internet, or reboots unexpectedly, deserves a closer look. If you find signs of compromise, isolate the device, update the firmware, and rotate any credentials stored on or passing through it.
For more background, see our earlier coverage: Zyxel Fixes Zero-Day Exploited to Hack Nearly 1,000 Switches and Zyxel GS1900 Patch Fails to Block Zero-Day Exploit.
What IT and security learners can take from this
The lesson is that a patch and an advisory do not prove you are safe. Here, the first report, from GreyNoise, pointed at the wrong bug, and devices stayed exposed. Binarly makes the same point: advisories and version numbers help, but they cannot be blindly trusted.
In practice, that means three habits. Keep an accurate asset inventory. Reduce exposure by keeping management interfaces off the internet. Watch for behavior, not just version numbers. These are core skills in vulnerability management and incident response, which CySA+ covers. If you are planning that path, read our CS0-003 retirement and CySA+ V4 guide first.
Browse our cybersecurity certification vouchers when you are ready to book an exam.
Sources
Questions about this topic
Is CVE-2026-7273 the same as CVE-2026-107441?
No. CVE-2026-7273 is a Zyxel bug patched in June that was first blamed for the attacks. Binarly says the attackers used a different, previously unknown flaw, now tracked as CVE-2026-107441.
Do I need a password for an attacker to exploit this flaw?
No. Zyxel says an unauthenticated attacker can exploit it with crafted HTTP requests. That is why keeping the web interface away from the internet matters.
Which Zyxel switches does this affect?
It affects 10 models in the GS1900 series. Check your exact model and firmware against the Zyxel advisory published on November 3.
Is updating the firmware enough?
Updating closes the hole, but it does not remove malware already on a compromised switch. Also restrict management access and review logs for unusual connections. If you suspect a compromise, isolate the device and rotate related credentials.
Who is blamed for the attacks?
GreyNoise linked the activity to Red Heron, a Chinese threat actor. Binarly says the malware used was variants of Jitterly and Sixzut, but that the exploit itself targeted a different flaw.
