Zyxel has patched a zero-day in its popular GS1900 series of smart managed switches after attackers used it to compromise nearly 1,000 devices worldwide and steal configurations and hashed root credentials. The flaw, tracked as CVE-2026-107441 and scored CVSS 8.8, is an out-of-bounds write in the switch web management CGI that lets a LAN-based, unauthenticated attacker run operating system commands through a crafted HTTP request. GreyNoise first spotted the campaign around August 17, 2026, tied to a suspected Chinese-speaking actor tracked as Kapibala, and counted 996 compromised switches across 48 countries. The twist that every network tech needs to hear: many of those boxes were already running the June security update for a different flaw, CVE-2026-7273, and were still wide open. Zyxel released Patch 3 firmware on October 22 and published its advisory on November 3. Here’s what happened, which models need attention, and why a “patched” switch still wasn’t safe.
The Campaign: Nearly 1,000 Switches, Wrong CVE
According to BleepingComputer and CSO Online, GreyNoise watched Kapibala hit GS1900 management interfaces, then drop a script that harvested device configurations, hashed root credentials and network details. GreyNoise linked the actor to the broader Red Heron campaign, which Acronis had previously tied to abuse of a critical flaw in the self-hosted Git service Gitea. When GreyNoise disclosed the Zyxel activity on September 21, the industry attributed it to CVE-2026-7273, the pre-authentication buffer overflow Zyxel had fixed in June. CISA even added that older CVE to its Known Exploited Vulnerabilities catalog the same day.
That attribution was wrong. Firmware security researchers at Binarly, while digging through Red Heron infrastructure tied to the JITTERLY backdoor and SIXZUT rootkit, found an exposed archive with an obfuscated Python exploit aimed squarely at GS1900 switches. The exploit specifically checked for firmware that had already been patched for CVE-2026-7273, then still succeeded. Binarly confirmed on September 28 that all ten firmware releases patched for the June bug remained exploitable.
Why the June Fix Wasn’t Enough
Binarly’s analysis, credited in Zyxel’s advisory to Yegor Vasilenko and Fernando Mercês, showed that the June update added checks meant to stop a buffer overflow, but attackers could bypass them by corrupting a parameter counter before it was validated. Combined with missing validation of HTTP parameter lengths, that let the exploit overwrite memory and execute commands without authentication. Zyxel treated the issue as a distinct vulnerability, assigned CVE-2026-107441 after confirming it on October 11, and shipped new firmware on October 22 that limits parameter sizes and validates the parameter count before copying data into memory.
Affected Models and Patch Targets
Zyxel’s November 3 advisory lists ten GS1900 models still inside their vulnerability support window. Anything on firmware ending in .2C0 or earlier is vulnerable; the fixed builds end in .3C0:
- GS1900-8: 2.90(AAHH.2)C0 and earlier → 2.90(AAHH.3)C0
- GS1900-8HP: 2.90(AAHI.2)C0 and earlier → 2.90(AAHI.3)C0
- GS1900-10HP: 2.90(AAZI.2)C0 and earlier → 2.90(AAZI.3)C0
- GS1900-16: 2.90(AAHJ.2)C0 and earlier → 2.90(AAHJ.3)C0
- GS1900-24 / 24E / 24EP / 24HPv2: matching 2.90(.2)C0 builds → matching (.3)C0 builds
- GS1900-48 / 48HPv2: matching 2.90(.2)C0 builds → matching (.3)C0 builds
Zyxel says on-market products not listed in that table are unaffected. If you already applied the June Patch 2 builds thinking you were done, you still need Patch 3.
What Compromised Switches Handed Over
Stolen switch configs and hashed root credentials are not a minor scrape. In a typical SMB or branch deployment, a GS1900 often sits at the edge of a VLAN fabric, so its config is a map of VLANs, trunks, management ACLs and upstream peers. Hashed credentials give attackers a head start on offline cracking and lateral movement. Treat any GS1900 that was internet-exposed or reachable from an untrusted LAN during the August–October window as potentially compromised until you verify otherwise.
- Inventory: pull a list of every GS1900 in production, including PoE and HP variants, and record the exact firmware string
- Patch: move each supported model to the matching 2.90(.3)C0 build from Zyxel’s advisory
- Assume breach for exposed units: change local admin credentials, rotate any SNMP communities or shared secrets stored on the box, and compare running config against a known-good backup
- Lock management: keep the web UI and SNMP off untrusted networks; prefer a dedicated management VLAN and allow-list admin hosts
- Watch the neighbors: Kapibala’s tooling collected network information, so check adjacent firewalls, VPN concentrators and domain controllers for follow-on activity
Looking Ahead
This episode is a warning about partial fixes. A vendor ships a security update, CISA lists the old CVE, and the ops team checks the box—while a related memory-corruption path stays open for months. Binarly’s find only surfaced because researchers chased the attacker’s own exploit archive. For shops that standardize on Zyxel access or aggregation switches, Patch 3 for the GS1900 line should be treated as emergency work this week, not a quiet quarterly firmware pass.
Expect more scrutiny of edge and closet switches in general. Soft targets with web UIs, discovery protocols and default SNMP are exactly what opportunistic and state-aligned actors are scanning for. If your monitoring doesn’t already alert on unexpected GS1900 config changes or sudden management-plane logins, now is a good time to add those signals.
Sources:
- Zyxel Security Advisory (GS1900 out-of-bounds write), November 3, 2026
- BleepingComputer, November 4, 2026
- CSO Online, November 5, 2026
- GreyNoise (Kapibala / Red Heron reporting), September 2026
