Zyxel fixes zero-day exploited to hack nearly 1,000 network switches

What it is

CVE-2026-107441 is a separate, previously unknown out-of-bounds write in the web management interface of ten Zyxel GS1900 switch models. An unauthenticated attacker with network access can run OS commands through specially crafted HTTP requests. Binarly found that the exploit works against all ten firmware releases that were patched for CVE-2026-7273 in June 2026, so those switches were not safe.

How it works

The June 2026 update for CVE-2026-7273 added checks to prevent a buffer overflow. Attackers bypassed them by corrupting a parameter counter before it was validated, which let the exploit overwrite memory and execute commands. Zyxel treats this as a distinct flaw because the exploit also abuses missing validation of HTTP parameter lengths.

Preconditions / Affected

• Ten GS1900 models are affected. The page does not list them.
• The attacker needs network access to the web management interface. No credentials are required.
• Firmware that carries only the June CVE-2026-7273 fix is still vulnerable.

What to do

Install the firmware Zyxel released on 22 October 2026. It limits parameter sizes and validates the parameter count before copying data into memory. The advisory was published on 3 November 2026. The page gives no workaround and no firmware version numbers, so take the exact versions from the advisory.

Anyone who treated CVE-2026-7273 as closed after the June update, or after CISA added it to the Known Exploited Vulnerabilities catalog on 21 September 2026, should check whether the October firmware is installed.

The observed attack downloaded a script that collected device configurations, hashed root credentials and network information. On switches that were exposed, treat that data as stolen. The page does not give indicators of compromise or a credential-rotation procedure.

Caveats

• GreyNoise reported in September 2026 that the Kapibala actor, linked to the Red Heron campaign, compromised 996 devices in 48 countries from about 17 August 2026. It attributed the activity to CVE-2026-7273, and Binarly later showed the exploit targeted a different flaw.
• The page says it is unclear whether the exploit was built to bypass the June patches or abused a related flaw those patches missed.
• Binarly reported the issue to Zyxel on 29 September 2026. Zyxel confirmed it on 11 October and assigned the CVE.
• Attribution to a suspected Chinese-speaking actor comes from GreyNoise and is described as suspected.