Zyxel zero-day hit 996 switches across 48 countries

Nearly a thousand Zyxel GS1900 switches in 48 countries were compromised before anyone knew which vulnerability was being exploited. The attacks were initially pinned on a flaw Zyxel had already fixed months earlier. Only later did firmware researchers discover that the exploit had been slipping past those very patches, targeting a separate bug that no one had reported.

The zero-day, now tracked as CVE-2026-107441, has been patched. But the sequence of events around it — a misattributed campaign, a catalog listing, and a late discovery — lays out how easily an attack can be assigned to the wrong root cause while the real hole stays open.

A flaw hiding in plain sight

Zyxel published a security advisory for CVE-2026-107441 on November 3, describing an out-of-bounds write in the web management interface of its GS1900 series switches. An unauthenticated attacker with network access could execute operating system commands by sending specially crafted HTTP requests.

The advisory covers ten GS1900 switch models. Zyxel released the corresponding security updates on October 22, roughly two weeks before the public disclosure. The flaw is classified as an out-of-bounds write because it allows memory to be overwritten past its intended boundary, which in turn permits command execution in the switch's operating system.

What makes this case different from a routine patch cycle is that the vulnerability was not recognized as new at first. It was mistaken for an older flaw that Zyxel had already addressed months before the attacks began.

The first patch, and the attacks that followed

On June 16, 2026, Zyxel released security updates for CVE-2026-7273, a pre-authentication buffer overflow affecting the same GS1900 switches. That fix was meant to close the door on unauthenticated exploitation of the management interface.

Starting around August 17, GreyNoise observed a suspected Chinese-speaking threat actor tracked as Kapibala exploiting Zyxel switches. According to GreyNoise, the attackers compromised 996 devices across 48 countries. The actor used the flaw to run commands remotely, then downloaded a script that collected device configurations, hashed root credentials, and network information.

GreyNoise linked Kapibala to the Red Heron hacking campaign, which Acronis previously reported was exploiting a critical vulnerability in the self-hosted Git service Gitea. The overlap in infrastructure and tooling tied the switch attacks to a broader operation already under scrutiny.

Attribution goes to the wrong CVE

When GreyNoise disclosed the campaign on September 21, it attributed the exploitation to CVE-2026-7273 — the vulnerability Zyxel had patched in June. That same day, CISA added CVE-2026-7273 to its Known Exploited Vulnerabilities catalog, requiring federal agencies to address the flaw.

The attribution was reasonable on its face. The target was the same switch family, the timing aligned with a known patch, and the attacks involved unauthenticated command execution against the management interface. But the conclusion was wrong in a way that kept the real vulnerability out of view.

Researchers at firmware security company Binarly found that the exploit used in the attacks actually targeted a separate, previously unknown vulnerability that remained unpatched. The public record had named one bug while the attackers were using another.

What Binarly found in the archive

Binarly discovered the discrepancy while investigating Red Heron infrastructure linked to the JITTERLY backdoor and SIXZUT rootkit. In that investigation, the researchers found an exposed archive containing an obfuscated Python exploit aimed at Zyxel GS1900 switches.

After analyzing the exploit, the researchers found that it specifically checked for firmware versions patched for CVE-2026-7273. That detail indicated the exploit had been developed or updated to target those versions — the ones that were supposed to be safe from the June flaw.

On September 28, Binarly confirmed that the exploit remained effective against all ten firmware releases patched for CVE-2026-7273. The earlier security update had not closed the path the attackers were using.

Bypassing the first fix

The June update added checks intended to prevent a buffer overflow. According to Binarly's analysis, attackers could bypass those checks by corrupting a parameter counter before it was validated. That allowed the exploit to overwrite memory and execute commands without authentication, even on switches running the earlier security updates.

Binarly reported its findings to Zyxel on September 29. The vendor confirmed the new vulnerability on October 11 and assigned it CVE-2026-107441. Zyxel classified it as a separate flaw rather than a failed patch because the exploit also abused missing validation of HTTP parameter lengths.

The distinction matters for how the fix was built. On October 22, Zyxel released new firmware updates that limit parameter sizes and validate the parameter count before copying data into memory. That approach blocks the exploitation technique Binarly documented.

The open question about intent

One point remains unresolved in the public account. The recovered exploit specifically targeted firmware patched for CVE-2026-7273, but it is unclear whether it was deliberately developed to bypass those updates or whether it exploited a related vulnerability that the earlier patches simply failed to address.

That ambiguity has consequences for defenders. A deliberate bypass implies the attacker had detailed knowledge of the patch and built around it. An accidental related flaw implies the original fix was incomplete in a way that may exist elsewhere. The source reporting does not settle which explanation is correct.

What is clear is that the June patch and the October patch address different problems, and only the later one closes the technique observed in the wild.

The numbers behind the campaign

• 996 devices compromised, according to GreyNoise
• 48 countries where affected devices were observed
• Ten GS1900 switch models listed as affected in Zyxel's advisory
• Ten firmware releases patched for CVE-2026-7273 remained exploitable, per Binarly's September 28 confirmation
• Attacks observed starting around August 17; public disclosure of the campaign on September 21
• Zyxel released fixes on October 22 and published its advisory on November 3

What administrators should do now

Zyxel's guidance is straightforward: administrators of affected GS1900 switches should install the latest firmware updates to protect against CVE-2026-107441. The October 22 release is the one that adds parameter-size limits and validates the parameter count before data is copied into memory.

Because the exploited flaw allowed unauthenticated command execution from the network, the exposure is not limited to the switch itself. The script observed in the campaign collected device configurations, hashed root credentials, and network information. Administrators who ran only the June update should treat their devices as potentially exposed and verify that the newer firmware is in place.

The CISA catalog entry for CVE-2026-7273 remains in effect for federal agencies, but that listing addresses the earlier flaw. The later CVE is the one tied to the actual exploit recovered by Binarly.

Why the misattribution matters

The episode suggests that catalog entries and public attributions can lag behind what attackers are actually using. When a campaign is linked to a known CVE, the natural response is to verify that the corresponding patch is applied. Here, that step would not have stopped the attacks.

For organizations running network switches at the edge of their infrastructure, the practical lesson is to treat firmware updates as a sequence rather than a single event. A switch that received the June update was still vulnerable to the October-disclosed flaw until the newer firmware was installed. This could mean that inventories which show "patched" need to be re-checked against the latest advisory, not the one that was current when the device was last updated.

The case also highlights the value of independent firmware analysis. It was Binarly's review of an exposed archive, not the initial campaign disclosure, that identified the gap between the patched CVE and the exploited one. This suggests that vulnerability attribution deserves the same scrutiny as the exploits themselves.