Zyxel Patches Zero-Day Used to Compromise Nearly 1,000 GS1900 Switches
Summary
Zyxel patched CVE-2026-107441, an unauthenticated command-execution flaw in ten GS1900 switch models. GreyNoise reported 996 devices compromised; Binarly found attackers bypassed earlier fixes. Zyxel released firmware updates October 22.
Key points
- CVE-2026-107441 is an out-of-bounds write flaw in the web management interface of ten Zyxel GS1900 switch models.
- The flaw allowed unauthenticated attackers with network access to execute operating-system commands through crafted HTTP requests.
- GreyNoise reported that a suspected Chinese-speaking actor tracked as Kapibala exploited the switches, with 996 devices compromised across 48 countries.
- The attackers reportedly collected device configurations, hashed root credentials, and network information.
- Binarly found the exploit targeted a separate, previously unknown flaw and could bypass earlier CVE-2026-7273 fixes by corrupting a parameter counter before validation.
- Zyxel released firmware updates on October 22 that limit parameter sizes and validate parameter counts before copying data into memory.
- It remains unclear whether the exploit was deliberately developed to bypass the earlier updates or used a related flaw those updates did not address.
Article Details
- Vulnerability Types
- Out-of-bounds write caused by missing validation of HTTP parameter lengths
- Severity
- Not disclosed
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Install the latest firmware updates for affected Zyxel GS1900 switches.
MITRE ATT&CK
T1005 · Data from Local SystemThe attackers' script collected configuration files, hashed root credentials, and network information from compromised Zyxel switches.T1105 · Ingress Tool TransferAfter exploiting the switches, attackers downloaded a script that collected device configurations, hashed root credentials, and network information.T1190 · Exploit Public-Facing ApplicationAttackers exploited an unauthenticated vulnerability in the Zyxel GS1900 web management interface to compromise switches.
CVE
CVE-2026-107441Zyxel · GS1900-10HP firmware; Zyxel · GS1900-16 firmware; +8 moreThe vulnerability, tracked as CVE-2026-107441, is an out-of-bounds write flaw in the switches' web management interface that allows an unauthenticated attacker with network access to execute operating system commandsCVE-2026-7273Zyxel · Gs1900-10hp firmware; Zyxel · Gs1900-16 firmware; +8 moreOn June 16, 2026, Zyxel released security updates addressing CVE-2026-7273, a pre-authentication buffer overflow vulnerability affecting the same GS1900 switches.
Threat Actors
Malware
JITTERLYWhile investigating Red Heron infrastructure linked to the JITTERLY backdoor and SIXZUT rootkit, Binarly researchers found an exposed archive containing an obfuscated Python exploit targeting Zyxel GS1900 switches.SIXZUTWhile investigating Red Heron infrastructure linked to the JITTERLY backdoor and SIXZUT rootkit, Binarly researchers found an exposed archive containing an obfuscated Python exploit targeting Zyxel GS1900 switches.