Zyxel GS1900 Zero-Day CVE-2026-107441 Patched After Attacks

If you run Zyxel GS1900 switches, the June firmware is not enough. Install the October 22 update.

BleepingComputer reports that Zyxel patched CVE-2026-107441, an out-of-bounds write in the switches’ web management interface. An unauthenticated attacker with network access can run operating system commands through crafted HTTP requests. It affects ten GS1900 models. Zyxel shipped the updates on October 22 and published its advisory on November 3.

What happened

• GreyNoise saw a suspected Chinese-speaking actor, tracked as Kapibala, exploiting these switches from around August 17. It counted 996 compromised devices in 48 countries.
• The attackers pulled device configurations, hashed root credentials and network information.
• GreyNoise disclosed the campaign on September 21 and pinned it on CVE-2026-7273, the flaw Zyxel patched on June 16. CISA added that CVE to KEV the same day. See our earlier coverage and the CVE-2026-7273 entry.
• Binarly found the exploit in an exposed archive on Red Heron infrastructure. It checked for firmware already patched for CVE-2026-7273 and still worked against all ten patched releases, as Binarly confirmed on September 28.
• Binarly reported to Zyxel on September 29. Zyxel confirmed a new flaw on October 11 and treated it as separate because the exploit also abused missing validation of HTTP parameter lengths.

The new firmware limits parameter sizes and validates the parameter count before copying data into memory.

What to do

1. Check every GS1900 you own against Zyxel’s advisory and install the October 22 or later firmware. Being on the June release means you are still exposed.
2. Take the management interface off any untrusted network. A switch web UI should not face the internet.
3. If a switch was reachable from the internet since mid-August, treat its configuration and root credentials as exposed. Rotate them, and rotate any secrets stored in the config.

Priority call: this goes ahead of routine patching for anyone with exposed management interfaces, because exploitation has already been confirmed in the field.

Open question

The source says it is unclear whether the attackers built the exploit to get around the June fix or hit a related flaw that fix missed. Either way, the lesson is the same: a KEV listing for one CVE does not prove the patch closed the hole.