A Zero-Day Kept Working After Zyxel's June Patch and Hit Nearly 1,000 Network Switches

Admins who installed Zyxel's June fix for its GS1900 switches had every reason to think they were safe. They were not. The attacks that compromised close to a thousand of those switches were running on a second, unknown bug that the June patch never touched.

Zyxel has now shipped firmware for that zero-day, tracked as CVE-2026-107441. It is an out-of-bounds write in the switches' web management interface that lets an unauthenticated attacker with network access run operating system commands. SecurityWeek reports a CVSS score of 8.8 across ten GS1900 models.

Blamed on the wrong bug

The story starts on 16 June, when Zyxel patched CVE-2026-7273, a pre-authentication buffer overflow on the same switches. From around 17 August, threat intelligence firm GreyNoise watched a suspected Chinese-speaking actor it calls Kapibala, linked to a group known as Red Heron, take over 996 devices across 48 countries. Italy, the United States, Taiwan and South Korea were among the hardest hit.

The attackers ran remote commands, then pulled down a script that harvested device configurations, hashed root credentials and network information. On 21 September GreyNoise went public and pinned the campaign on CVE-2026-7273. CISA added that bug to its Known Exploited Vulnerabilities catalog the same day.

The patch was out. The bug was named. The case looked closed.

The exploit that outlived the fix

Firmware security company Binarly then found an exposed archive on Red Heron infrastructure, alongside a backdoor and a rootkit. Inside was an obfuscated Python exploit aimed at the switches. On 28 September Binarly confirmed that it still worked against all ten firmware releases carrying the June fix.

The earlier update had added buffer overflow checks, but the attackers had a way around them, and the firmware also failed to validate the length of incoming parameters. Binarly reported the problem to Zyxel on 29 September, and the vendor confirmed it as a new vulnerability on 11 October.

Corrective firmware followed around 22 October, adding limits on parameter sizes and validation before data is copied into memory. Zyxel published its advisory on 3 November. Firmware ending in 2.90 Patch 2 or earlier is vulnerable, and the model-specific 2.90 Patch 3 fixes it. The affected models are the GS1900-8, 8HP, 10HP, 16, 24, 24E, 24EP, 24HPv2, 48 and 48HPv2.

It has been a rough week for things admins assumed were trustworthy. Debian and Ubuntu just pushed emergency fixes for an APT flaw that let a network attacker swap verified packages and run code as root. The Zyxel case is worse in one respect: the owners of these switches had done the right thing, and the attackers stayed in anyway.

Patch 3 closes the hole, but it does not undo what was already taken. Any switch exposed during the campaign may have handed over its configuration and credential hashes, so owners have reason to keep management interfaces off the open internet and check for changes they did not make.

Some offers on this page may be paid placements or contain affiliate links.