Zyxel’s June Patch Didn’t Stop the Switch Hack. This One Does
Binarly found the exploit used to hack 996 Zyxel GS1900 switches worked on firmware patched for CVE-2026-7273; Zyxel fixed the real bug, CVE-2026-107441, on Oct. 22.
The Zyxel switch bug that hackers used to break into nearly 1,000 GS1900 switches wasn’t the one everyone thought. Firmware firm Binarly found that the exploit kept working on switches already patched for CVE-2026-7273, and Zyxel has now fixed the real hole, CVE-2026-107441, according to BleepingComputer. If you patched in June and stopped there, your switch was still open.
For defenders
Affected: ten Zyxel GS1900 series switch models. Zyxel’s CVE record lists firmware through 2.90(AAHK.2)C0 for the GS1900-24E; check the Nov. 3 advisory for each model’s fixed build. Fixed firmware shipped Oct. 22.
The bug: CVE-2026-107441 is an out-of-bounds write in the web management CGI that lets an unauthenticated attacker run OS commands with crafted HTTP requests. Zyxel scores it CVSS 8.8 (adjacent network). Binarly says the June fix for CVE-2026-7273 added overflow checks, but attackers could corrupt a parameter counter before it was checked; Zyxel also cites missing length checks on HTTP parameters. The new firmware caps parameter sizes and validates the count before copying.
Exploitation: KNOWN. GreyNoise saw a suspected Chinese-speaking actor it tracks as Kapibala exploiting GS1900 switches from about Aug. 17, compromising 996 devices in 48 countries (T1190 (Exploit Public-Facing Application)). After running commands, the attackers pulled a script that collected device configurations, hashed root credentials and network details (T1005 (Data from Local System)). GreyNoise first blamed CVE-2026-7273, and CISA added that CVE to KEV on Sept. 21. Binarly then found an obfuscated Python exploit in an exposed archive on infrastructure tied to the Red Heron campaign (JITTERLY backdoor, SIXZUT rootkit) that checked for CVE-2026-7273-patched firmware, and on Sept. 28 confirmed it worked against all ten patched releases. One public proof-of-concept repository is reported on GitHub.
Still unclear: whether the exploit was built on purpose to beat the June patch or simply hit a related bug the patch missed. No network indicators were published in the coverage.
What it means for you
The GS1900 is a small managed switch common in offices, shops and home labs. If you have one, the update you may have installed this summer didn’t close the door attackers were actually using. Anyone who got in could read the switch’s settings and password hashes, which helps them move further into your network.
Do this now
- Install Zyxel’s October 22 firmware (or later) on every GS1900 switch, even ones you patched in June.
- Make sure the switch’s web management page can’t be reached from the internet or from guest and untrusted networks.
- If a switch was exposed this year, treat its admin password and any credentials in its config as stolen: change them, and review the config for changes you didn’t make.
CVE at a glance
- CVSS
- 8.8 High (v3.1)
- EPSS
- 0.3% chance of exploitation in the next 30 days (higher than 22% of CVEs)
- Exploited in the wild
- Not on CISA’s KEV list
- Public exploit
- Yes, reported in 1 GitHub repository
- CVSS
- 8.8 High (v3.1)
- EPSS
- 2.8% chance of exploitation in the next 30 days (higher than 86.4% of CVEs)
- Exploited in the wild
- Yes, on CISA’s KEV list since Sep 21, 2026
- Public exploit
- None reported in public exploit databases
Data from NVD, FIRST EPSS and CISA KEV, refreshed automatically. We report whether public exploit code exists but never link to it: fake proof-of-concepts that infect researchers are common.