Zyxel GS1900 zero-day exploited in nearly 1,000 switch attacks

Binarly found a zero-day in Zyxel GS1900 series switches that was exploited to hack almost 1,000 devices, SecurityWeek reported on Thursday. Zyxel released firmware v2.90 Patch 3 and published an advisory on November 3, according to SecurityWeek.

The flaw is CVE-2026-107441, rated CVSS 8.8. Zyxel describes it as an out-of-bounds write in the CGI program of GS1900 firmware; an unauthenticated attacker can send crafted HTTP requests and achieve OS command execution. BleepingComputer described the bug as sitting in the web management page, where an unauthenticated attacker with network access can make the switch run chosen commands, 2-Spyware said.

The vulnerable range is 10 GS1900 switch models. SecurityWeek dated the fixes to October 23, while 2-Spyware said they shipped on October 22. Both outlets reported the advisory on November 3.

On September 21, GreyNoise warned that attackers had broken into around 1,000 devices in August by exploiting CVE-2026-7273, a Zyxel flaw fixed in June. The firm tied the activity to Red Heron, a Chinese threat actor Acronis had seen targeting Gitea instances, and CISA moved CVE-2026-7273 into its KEV catalog. GreyNoise logged 996 devices hit in 48 countries since about August 17, 2026, and found 564 still used factory default credentials, according to 2-Spyware. Help Net Security put Italy, the United States, Taiwan and South Korea among the highest-hit locations, 2-Spyware reported. Zyxel had described that earlier flaw as allowing a “LAN-based, unauthenticated attacker” to use a crafted web request, 2-Spyware said. After getting command execution, attackers made each switch download a script that copied its configuration, network details and the hashed root password.

Binarly now says the attackers never touched CVE-2026-7273. They dropped Jitterly and Sixzut malware variants that Acronis had analyzed, but their exploit relied on a previously unknown vulnerability. “Because the threat actor was exploiting a different vulnerability, and the patch for CVE-2026-7273 remained ineffective, this had no effect on protecting devices from being exploited by this threat actor,” Binarly said.

Binarly told Zyxel on September 29, and two weeks later the vendor confirmed the new vulnerability, SecurityWeek reported. 2-Spyware said Binarly confirmed on September 28 that the exploit worked on all ten firmware versions carrying the June fix; Zyxel confirmed the separate flaw on October 11. The June patch added size checks, but attackers bypassed them by corrupting a counter before the check ran, 2-Spyware reported, citing BleepingComputer. Binarly also said, “Advisories and version numbers certainly help, but they cannot be blindly trusted,” and argued that binary code review is the definitive way to assess software, according to SecurityWeek.

CISA had set a federal deadline to fix CVE-2026-7273 by September 24, 2026, 2-Spyware reported. Zyxel's fix restricts the size of web request values and counts how many arrive before copying them into memory, 2-Spyware said. Administrators should install the latest GS1900 firmware, change default admin passwords, keep the management interface off the internet, and compare devices with GreyNoise indicators of compromise.