Zyxel has patched a previously unknown zero-day vulnerability in its GS1900 series network switches after hackers exploited the flaw to compromise nearly 1,000 devices worldwide. The attackers used the vulnerability to steal configuration files and credentials from affected systems across 48 countries. The flaw, tracked as CVE-2026-107441, is an out-of-bounds write issue within the switches' web management interface that allows unauthenticated attackers with network access to execute operating system commands via specially crafted HTTP requests.
The vulnerability impacts ten specific GS1900 switch models. Zyxel released security updates on October 22 and published a formal security advisory on November 3. Initially, the attacks were misidentified as an exploitation of an older flaw that had already been patched months prior. On June 16, 2026, Zyxel had issued updates for CVE-2026-7273, a pre-authentication buffer overflow vulnerability affecting the same hardware. However, researchers later determined that the active attacks were targeting a separate, unpatched issue.
Cybersecurity firm GreyNoise first observed the campaign around August 17, attributing it to a suspected Chinese-speaking threat actor known as Kapibala. The group compromised 996 devices and deployed scripts to collect device configurations, hashed root credentials, and network information. GreyNoise linked Kapibala to the Red Heron hacking campaign and initially attributed the exploitation to CVE-2026-7273, leading CISA to add that identifier to its Known Exploited Vulnerabilities catalog on September 21.
Researchers at Binarly later discovered that the exploit actually targeted a distinct vulnerability. While investigating Red Heron infrastructure associated with the JITTERLY backdoor and SIXZUT rootkit, they found an exposed archive containing an obfuscated Python exploit designed for Zyxel GS1900 switches. Analysis revealed that the exploit specifically checked for firmware versions patched against CVE-2026-7273, indicating it was developed or updated to bypass those specific updates.
Binarly confirmed on September 28 that the exploit remained effective against all ten firmware releases intended to fix the earlier buffer overflow. The researchers found that while the June update added checks to prevent buffer overflows, attackers could bypass them by corrupting a parameter counter before validation. This allowed the exploit to overwrite memory and execute commands without authentication even on patched devices. Binarly reported these findings to Zyxel on September 29, and the vendor confirmed the new vulnerability on October 11.
Zyxel classified CVE-2026-107441 as a separate flaw because the exploit also abused missing validation of HTTP parameter lengths. The October 22 firmware updates address this by limiting parameter sizes and validating the parameter count before copying data into memory. It remains unclear whether the exploit was deliberately crafted to bypass the June patches or if it exploited a related vulnerability that the earlier updates failed to fully address. Administrators are advised to install the latest firmware immediately to protect against CVE-2026-107441.
Sources: BleepingComputer.