Zyxel patches GS1900 zero-day exploited to compromise 996 switches

Zyxel issued security updates on Oct. 22 and published an advisory on Nov. 3 for a zero-day flaw in its GS1900 series switches after attackers breached nearly 1,000 devices worldwide.

The bug is tracked as CVE-2026-107441 in the GS1900 series web management interface. An unauthenticated attacker with network access can execute operating system commands by sending specially crafted web requests to the web management interface. 10 GS1900 switch models are affected. Zyxel described the threat as a “LAN-based, unauthenticated attacker”.

Attackers ran commands from a distance and then forced each switch to download a script that harvested device settings, hashed root passwords, and network details. They also took configuration files and credentials. GreyNoise said a suspected Chinese-speaking actor called Kapibala was exploiting the switches from around Aug. 17, and it counted 996 compromised devices across 48 countries.

GreyNoise tied Kapibala to the Red Heron campaign. Acronis had said earlier that the campaign exploited a critical flaw in Gitea, described as a self-hosted Git service.

GreyNoise also found that 564 victims were still using factory default credentials, so many had never altered the password that came with the switch. The compromised switches sit mainly in Italy, the United States, Taiwan, South Korea, and several EU countries.

GS1900 Series switches are Gigabit Ethernet devices built for small and mid-sized business networks, typically found in small offices, schools, hotels, and retail shops. If a switch is hijacked, every connected computer, till, and printer on the premises is exposed, because the device links everything in a small office or shop. Owners of basic unmanaged switches at home are not at risk because the flaw lives in this series’ web management feature.

Zyxel released updates on June 16, 2026, to fix CVE-2026-7273, a buffer overflow that requires no authentication, in the same GS1900 switches. That older flaw affects switches running firmware 2.90(XXXX.1)C0 and earlier. The script used in the earlier attacks works on GS1900-24 firmware from 2.10 to 2.90. CISA told federal agencies to patch CVE-2026-7273 by Sept. 24, 2026.

Researchers at firmware security company Binarly found that the attack exploit targeted a different, earlier unknown flaw that remained unpatched. On Sept. 28, Binarly confirmed that the exploit worked on all 10 firmware versions patched for CVE-2026-7273. The June update added checks to stop a buffer overflow, but attackers defeated them by corrupting a parameter counter before validation. That let the exploit corrupt memory and execute unauthenticated commands on switches with the older updates.

Binarly told Zyxel about the findings on Sept. 29. The vendor confirmed the new flaw on Oct. 11 and gave it the identifier CVE-2026-107441. Zyxel called it a separate flaw because the attack also took advantage of missing validation of HTTP parameter lengths. The firmware issued on Oct. 22 limits parameter sizes and checks how many parameters arrive before data is copied into memory.

The updates stop the exploitation technique. It remains unclear whether attackers created the exploit specifically to bypass the June patch or exploited a related bug the earlier patch did not catch. GreyNoise attributed the September attacks to the flaw. CISA added it to its actively exploited bugs list on Sept. 21.

No tally has been published for the number of the 996 switches that were cleaned, and many owners probably have no idea they were hit. As of September, Zyxel had not updated its older advisory to show that the earlier flaw was under active exploitation. Those watching the situation expect pressure on Zyxel to revise its advisories, and they expect CISA to add the new flaw after exploitation is confirmed.

GreyNoise shared indicators of compromise while holding back one exploitation IP address. GreyNoise said, “We are withholding the exact IP address due to victim sensitivities and operational risk.”

Customers should assume the previous password is exposed and change any other account that used it. Those running affected Zyxel GS1900 switches should install the latest firmware to defend against CVE-2026-107441.