Zyxel GS1900 zero-day exploited in wild despite patch
Original title: Zyxel Switch Hacks Blamed on Patched Flaw Actually Exploited a Zero-Day
Attackers used CVE-2026-107441 to compromise nearly 1,000 Zyxel switches after it was misattributed to a patched flaw.
A zero-day out-of-bounds write vulnerability (CVE-2026-107441) in Zyxel GS1900 series switches was exploited in the wild. The flaw allows unauthenticated OS command execution via crafted HTTP requests. Zyxel patched it on October 23 but the attacks were initially blamed on a different CVE-2026-7273.
Unconfirmed: Whether the patch fully mitigates all exploitation
- Impacts 10 GS1900 switch models
- CVSS 8.8
- Exploited by variants of Jitterly and Sixzut malware
- Binarly notified Zyxel September 29
- Patch ineffective for previous attacks
Impact: unauthenticated OS command execution on switches
| Product | Affected | Fixed in |
|---|---|---|
| Zyxel GS1900 series switches | before patch | October 23 |
- 1.Upgrade to patched firmware
- 2.Monitor for suspicious HTTP requests
- CVEs
- CVE-2026-107441
- Products
- GS1900 series switches
- Countries
- China
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-107441 | Out-of-bounds write in Zyxel GS1900-24E CGI up to 2.90(AAHK.2)C0 | 8.8 | — |
From the original article
2 min read at securityweek.com
Tracked as CVE-2026-107441, the out-of-bounds write flaw could allow attackers to execute OS commands via crafted HTTP requests. The post Zyxel Switch Hacks Blamed on Patched Flaw Actually Exploited a Zero-Day appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.