Zyxel GS1900 switch zero-day CVE-2026-107441 lets attackers run root commands before login, now patched

What happened

Zyxel patched CVE-2026-7273, a pre-authentication buffer overflow in GS1900 switches, on June 16, 2026 (BleepingComputer). Starting around August 17, GreyNoise saw a suspected Chinese-speaking actor tracked as Kapibala exploit these switches and compromise 996 devices across 48 countries (BleepingComputer). The attackers ran commands remotely, then pulled a script that collected device configurations, hashed root credentials and network information (BleepingComputer). Of those switches, 564 still used factory default logins, and Italy, the United States and Taiwan had the most victims (Cyber Security News).

GreyNoise first attributed the attacks to CVE-2026-7273 on September 21, and CISA added that CVE to its Known Exploited Vulnerabilities catalog the same day (BleepingComputer). Binarly then found that the exploit actually targeted a separate, previously unknown flaw. While investigating Red Heron infrastructure linked to the JITTERLY backdoor and SIXZUT rootkit, it recovered an exposed archive holding an obfuscated Python exploit (BleepingComputer). The exploit checked for firmware versions patched for CVE-2026-7273. On September 28 Binarly confirmed it still worked against all ten firmware releases patched for that CVE (BleepingComputer).

Technical cause, as reported by Cyber Security News and BleepingComputer:

• The flaw is an out-of-bounds write in the switch web management interface, in the dispatcher.cgi program. An unauthenticated attacker with network access can run operating system commands using crafted HTTP requests. The same weak code also exists in httprestorecfg.cgi and httpupload.cgi.
• Request parameters are stored in a fixed block of 140 slots of 1,024 bytes each. The code copies data first and checks the count afterward, so a long value in slot 139 overwrites the counter. Setting the counter negative lets the attacker write before the block and overwrite function pointers.
• Zyxel’s earlier patch added a count check, but the bad copy still happens before that check runs.

Binarly reported the issue to Zyxel on September 29. Zyxel confirmed it on October 11 as CVE-2026-107441, treating it as a separate flaw because the exploit also abused missing validation of HTTP parameter lengths. Zyxel shipped new firmware on October 22 and published its advisory on November 3 (BleepingComputer). The new firmware limits parameter sizes and validates the parameter count before copying data (BleepingComputer). Binarly also published its own write-up (Binarly).

Points of disagreement and uncertainty:

• Cyber Security News reports a 9.8 critical score for the flaw. It also says Binarly argues Zyxel described the bug wrongly, since it lives in global memory rather than on the stack, and that Binarly rates it higher than the 8.8 Zyxel assigned (Cyber Security News).
• It remains unclear whether the exploit was deliberately built to bypass the June updates or abused a related flaw those patches failed to address (BleepingComputer).
• GreyNoise ties the actor to the Gitea campaign that Acronis called Red Heron, based on shared servers and malware (Cyber Security News). That campaign used JITTERLY, a Linux backdoor with more than 30 commands, and the SIXZUT rootkit.

Am I affected?

You are affected if you operate Zyxel GS1900 series switches that have not been updated to the October 22 firmware or newer. BleepingComputer says the flaw affects ten GS1900 models (BleepingComputer). The exact model list and firmware version numbers are not confirmed in the sources provided here, so check Zyxel’s November 3 advisory.

Firmware that was patched for CVE-2026-7273 is not enough, because the exploit still worked against all ten of those releases (Cyber Security News). Risk is highest for switches whose web management is reachable from untrusted networks or that still use default logins. The flaw works over normal HTTP from any network that can reach the switch (Cyber Security News).

Because attackers stole hashed root credentials, treat any exposed switch as possibly compromised (Cyber Security News).

What to do now

1. Inventory all Zyxel GS1900 switches, including any that were patched in June for CVE-2026-7273.
2. Update every unit to the October 22 firmware or newer from Zyxel (Cyber Security News).
3. Remove web management pages from the internet and restrict them to trusted admin networks.
4. Change all default passwords right away, and rotate credentials on any switch that was exposed.
5. Check devices for odd admin activity, changed settings and strange web requests, as CISA advises (Cyber Security News).
6. Hunt for JITTERLY and SIXZUT using the SHA-256 indicators published by Cyber Security News (Cyber Security News).
7. Do not rely on the CISA catalog entry for CVE-2026-7273 as proof of coverage, since Binarly says the attacks hit a different bug than the one CISA named, or that the first patch was wrong (Cyber Security News).

Sources

• Binarly, New Zyxel GS1900 pre-auth RCE vulnerability revealed
• Cyber Security News, Hackers Exploit Zyxel GS1900 Zero-Day in the Wild to Hijack Network Switches
• BleepingComputer, Zyxel fixes zero-day exploited to hack nearly 1,000 network switches