Zyxel Patches Zero-Day That Hit Nearly 1,000 Network Switches

A security patch from Zyxel is now available for a zero-day vulnerability in the company's GS1900 managed network switches - a flaw attackers used to quietly break into roughly 1,000 devices worldwide and collect configuration files and hashed login credentials. The vendor pushed updated firmware on October 22 and followed with a public advisory on November 3.

GS1900 switches are designed for small and mid-size business networks. These devices direct traffic between computers and other hardware on a local network; gaining access to one gives an attacker a vantage point to watch data move across the organization or push further into internal systems. The switches include a browser-based management interface - and that console is exactly what the new vulnerability put at risk.

A Zyxel switch zero-day vulnerability hidden inside a patched product

That means the software writes data beyond its designated memory space, an error that attackers can exploit to hijack the device. No login is required; anyone who can reach the management interface across the network can send specially crafted HTTP requests and run operating system commands on the switch.

Ten models in the GS1900 family are affected. Zyxel logged the new CVE as a separate issue partly because the exploit also took advantage of the device's failure to verify the length of HTTP parameters it received.

Part of the reason this flaw went undetected for months is that it closely resembled a problem the company had already addressed. On June 16, 2026, Zyxel issued firmware addressing CVE-2026-7273, a pre-authentication buffer overflow bug affecting the same switch family. Any organization that applied that update had good reason to believe its devices were secure. As it turned out, they were not.

How the attack campaign spread

Security monitoring firm GreyNoise first detected the intrusions beginning around August 17. The group responsible, which GreyNoise tracks as Kapibala and describes as a suspected Chinese-speaking threat actor, had broken into 996 devices across 48 countries by the time the campaign surfaced publicly. On each compromised switch, the attackers ran remote commands and then pulled down a script that gathered device settings, hashed root passwords, and network information.

Hashed credentials are passwords stored as a scrambled string rather than plain text. That storage method offers some protection, but attackers who obtain the hash can still try to crack it offline using automated tools, or exploit it in certain types of network intrusions.

GreyNoise connected Kapibala to a wider effort it calls the Red Heron campaign. Security company Acronis had previously reported Red Heron exploiting a critical hole in Gitea, a self-hosted platform developers use to store and version source code.

GreyNoise went public with the Zyxel campaign on September 21, attributing the attacks to CVE-2026-7273. That same day, the Cybersecurity and Infrastructure Security Agency placed CVE-2026-7273 on its Known Exploited Vulnerabilities list, directing federal agencies to apply the June patch. At that point, every party involved believed the June fix was the right one.

How researchers found the real flaw

Firmware analysis firm Binarly reached a different conclusion while digging into Red Heron infrastructure tied to two malware components - a backdoor called JITTERLY and a rootkit called SIXZUT. During that work, the researchers came across an open archive holding an obfuscated Python script aimed at GS1900 devices.

That meant the tool had been built - or at least revised - to function against switches administrators considered protected.

Binarly confirmed by September 28 that the script worked on every one of the ten patched firmware releases. The June update had blocked one entry route, but the exploit found a workaround: by corrupting a counter that tracked incoming parameters before the device could validate it, attackers could still force memory corruption and execute commands without any credentials - including on hardware carrying the earlier patch.

Binarly delivered its findings to Zyxel on September 29. Zyxel confirmed the new vulnerability on October 11, assigning the CVE-2026-107441 identifier. The gap between the two CVE numbers meant that for several weeks, security teams, device owners and a federal watchdog were all pointing to the wrong patch. Organizations that had applied only the June update remained exposed throughout the August attack wave.

What the new firmware fixes

The October 22 updates tackle the problem on two fronts. The firmware now caps the size of incoming parameters and checks the parameter count before writing data into memory. Both changes together close the opening the exploit used to overwrite memory and issue unauthorized commands.

Whether the attackers built their tool deliberately to get around the June patch, or encountered a related flaw the earlier fix never addressed, is still unclear. In either case, organizations relying solely on the June update were exposed from August onward.

Steps for businesses running affected switches

Zyxel advises administrators managing any of the ten affected GS1900 models to install the latest firmware right away.

Security teams should also examine credential reuse. Because the attackers gathered hashed root passwords from every device they hit, any password shared between a compromised switch and other network systems is a risk. Resetting credentials on affected hardware, and anywhere those passwords appear elsewhere, is a practical first step.

Teams should also pull logs covering mid-August through late September. Unusual commands on managed switches or unexpected outbound traffic during that window could point to earlier compromise that went unnoticed.

The incident highlights a gap in how patch management is often practiced. When a vendor releases a second update for a product that was already serviced, security teams should confirm which specific vulnerability the new release targets - and not assume that an older fix still provides full coverage.