Hackers Exploit Zyxel GS1900 Zero-Day in the Wild
Original title: Hackers Exploit Zyxel GS1900 Zero-Day in the Wild to Hijack Network Switches
Patch for CVE-2026-7273 left switches vulnerable to new CVE-2026-107441 remote root command execution.
Hackers exploited a Zyxel GS1900 dispatcher.cgi flaw allowing unauthenticated root command execution. Binarly found the public exploit hit a different bug than Zyxel's initial patch. GreyNoise reported attacks on 996 switches in 48 countries, with the actor linked to the Red Heron campaign.
Unconfirmed: Whether Zyxel's first patch covered the exploited flaw or a different one.
- CVE-2026-107441 scored 9.8 critical by Binarly.
- Flaw exists in global memory allowing buffer overflow.
- 564 switches still used factory default logins.
- Italy, United States, and Taiwan had most victims.
- Actor stole device settings and hashed root passwords.
Impact: unauthenticated remote code execution as root
| Product | Affected | Fixed in |
|---|---|---|
| Zyxel GS1900 switches | all ten fixed firmware releases | October 22 fix |
- 1.Update to October 22 fix or newer
- 2.Remove web management from internet
- 3.Change all default passwords
- Vendors
- Zyxel
- Products
- GS1900 switches
- Threat actors
- Red Heron
- Countries
- ItalyUnited StatesTaiwan
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-107441 | Out-of-bounds write in Zyxel GS1900-24E CGI up to 2.90(AAHK.2)C0 | 8.8 | — | ||
| CVE-2026-7273 | Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability | 8.8 | 3% | KEVPoC | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha256 | 0f6e757e82c4d91df5bd249f775b9970b59dee42cc0dfe40f879d77fc16821c6 | cators of Compromise Malware Type SHA-256 JITTERLY Backdoor 0f6e757e82c4d91df5bd249f775b9970b59dee42cc0dfe40f879d77fc16821c6 JITTERLY Backdoor 663a8088faca8e126a11648f5671fcf4eaf96435e |
| sha256 | 295133156b6a7d95b9c92f832f49e35235f1fbd3906e75c9202ef4cd65d1018c | 6a576eadf2c986a51f0de986d50db4e49be01bf125cb SIXZUT Rootkit 295133156b6a7d95b9c92f832f49e35235f1fbd3906e75c9202ef4cd65d1018c SIXZUT Rootkit 64677002011bc2e4bc642a4154a20fdb95620ebd0144 |
| sha256 | 64677002011bc2e4bc642a4154a20fdb95620ebd0144b98fc60f917901ec8b92 | 2f832f49e35235f1fbd3906e75c9202ef4cd65d1018c SIXZUT Rootkit 64677002011bc2e4bc642a4154a20fdb95620ebd0144b98fc60f917901ec8b92 SIXZUT Rootkit 728810b07e911b235f6450e784391e39f68819a0a5d2 |
| sha256 | 663a8088faca8e126a11648f5671fcf4eaf96435e10daf63a1d1b17d8385154c | f775b9970b59dee42cc0dfe40f879d77fc16821c6 JITTERLY Backdoor 663a8088faca8e126a11648f5671fcf4eaf96435e10daf63a1d1b17d8385154c JITTERLY Backdoor 82d072ab03d90c0131b06a576eadf2c986a51f0de |
| sha256 | 728810b07e911b235f6450e784391e39f68819a0a5d209662162916ffea25146 | 2a4154a20fdb95620ebd0144b98fc60f917901ec8b92 SIXZUT Rootkit 728810b07e911b235f6450e784391e39f68819a0a5d209662162916ffea25146 Give your SOC the alert context to stops incidents quickly. |
| sha256 | 82d072ab03d90c0131b06a576eadf2c986a51f0de986d50db4e49be01bf125cb | f5671fcf4eaf96435e10daf63a1d1b17d8385154c JITTERLY Backdoor 82d072ab03d90c0131b06a576eadf2c986a51f0de986d50db4e49be01bf125cb SIXZUT Rootkit 295133156b6a7d95b9c92f832f49e35235f1fbd3906e |
From the original article
3 min read at cybersecuritynews.com
A flaw in Zyxel GS1900 switches was already being used by hackers, and the patch meant to fix it did not work. Researchers at Binarly found that a public exploit hit a different bug than the one Zyxel had patched. Zyxel has now confirmed it as a new flaw, tracked as CVE-2026-107441.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.