Zyxel fixes zero-day exploited to hack nearly 1,000 network switches
Zyxel patched CVE-2026-107441 after Kapibala exploited it to compromise 996 GS1900 switches and steal credentials; the flaw bypassed a prior patch for CVE-2026-7273.
Zyxel GS1900 network switches were compromised worldwide starting August 2026 by a suspected Chinese-speaking threat actor tracked as Kapibala, who used a zero-day out-of-bounds write in the web management interface to execute commands and download configurations and hashed credentials. The exploit targeted firmware patched for CVE-2026-7273 and was linked to the Red Heron campaign and backdoors JITTERLY and SIXZUT. Binarly discovered the separate CVE-2026-107441 on September 28 after finding an exposed exploit archive; Zyxel confirmed it on October 11 and released fixes on October 22 that limit parameter sizes and validate counts before memory copy.
Unconfirmed: Unclear if the exploit was specifically developed to bypass the CVE-2026-7273 patch or targeted a related flaw that prior updates failed to address
- 996 devices across 48 countries compromised
- Exploit bypasses checks added for CVE-2026-7273
- Binarly reported findings September 29
- CISA added CVE-2026-7273 to KEV catalog
- New firmware limits HTTP parameter sizes
Impact: unauthenticated remote code execution on network switches
- 1.Upgrade to latest Zyxel GS1900 firmware
- 2.Check for parameter length validation bypasses
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-107441 | Out-of-bounds write in Zyxel GS1900-24E CGI up to 2.90(AAHK.2)C0 | 8.8 | — | ||
| CVE-2026-7273 | Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability | 8.8 | 3% | KEVPoC | KEV |
From the original article
2 min read at bleepingcomputer.com
Zyxel has patched a zero-day vulnerability in its GS1900 series network switches that hackers exploited to compromise nearly 1,000 devices worldwide and steal configuration files and credentials. [...]
By Lawrence Abrams · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.