cyber.hendryadrian.com
Vulnerability & Exploit · securityweek.com

Zyxel GS1900 Attacks Exploited Zero-Day CVE-2026-107441, Binarly Says

· Original article ↗

Summary

Binarly says attackers exploited a previously unknown flaw in Zyxel GS1900 switches, not the previously suspected CVE-2026-7273, and hacked nearly 1,000 devices. Zyxel patched CVE-2026-107441 and issued an advisory.

Key points

  • Binarly reports that attackers exploited CVE-2026-107441 as a zero-day in attacks that hacked nearly 1,000 Zyxel GS1900 switches.
  • The flaw is an out-of-bounds write in the switches’ CGI program; Zyxel says crafted HTTP requests can enable unauthenticated OS command execution.
  • The vulnerability affects 10 GS1900 models. Zyxel released fixes on October 23 and published an advisory on November 3.
  • The attacks had previously been attributed to CVE-2026-7273, but Binarly says the attackers exploited the previously unknown CVE-2026-107441 instead.
  • GreyNoise linked the earlier activity to Red Heron, a Chinese threat actor.
  • The attackers deployed variants of Jitterly and Sixzut malware analyzed by Acronis.

Article Details

Vulnerability Types
  • Out-of-bounds write
Severity
CVSS 8.8
Exploitation Status
active
Exploit Availability
unknown
Patch Status
available

CVE

CVE-2026-107441Zyxel · GS1900-10HP firmware; Zyxel · GS1900-16 firmware; +8 moreThe flaw is tracked as CVE-2026-107441 (CVSS score of 8.8) and is described as an out-of-bounds write issue in the CGI program of the Zyxel GS1900 series switch firmware.CVE-2026-7273Zyxel · GS1900-10HP firmware; Zyxel · GS1900-16 firmware; +8 moreThe previous report came from GreyNoise, which warned on September 21 that the hackers exploited CVE-2026-7273, a Zyxel bug patched in June, to compromise roughly 1,000 devices in August.

Threat Actors

Red HeronGreyNoise linked the attacks on roughly 1,000 devices to Red Heron; the article reports that those attacks exploited CVE-2026-107441 rather than CVE-2026-7273.

Malware

JITTERLYThey deployed variants of the Jitterly and Sixzut malware analyzed by Acronis, but their exploit targeted a previously unknown vulnerability.SIXZUTThey deployed variants of the Jitterly and Sixzut malware analyzed by Acronis, but their exploit targeted a previously unknown vulnerability.

Vendors

ZyxelA recently patched vulnerability in Zyxel GS1900 series switches was exploited in the wild as a zero-day to hack almost 1,000 devices, cybersecurity firm Binarly reports.

Products

Zyxel GS1900 series switchesA recently patched vulnerability in Zyxel GS1900 series switches was exploited in the wild as a zero-day to hack almost 1,000 devices, cybersecurity firm Binarly reports.

Related Articles