Zyxel Patched a GS1900 Switch Bug in June. The Exploit Still Worked Against Every Patched Firmware. 996 Switches Were Taken, and Fixed Firmware Came October 22.

If you run a Zyxel GS1900 switch, check its firmware against the table below and install the 2.90 build ending in .3C0 for your model. The June fix for the earlier bug did not hold. Binarly reports its exploit worked against all ten firmware releases that Zyxel patched for CVE-2026-7273, and Zyxel assigned a new number, CVE-2026-107441, with fixes released October 22 and an advisory published November 3. Zyxel lists no workaround. The only guidance is to patch.

What happened

CVE-2026-7273 is a pre-authentication buffer overflow in the GS1900 web management interface. Zyxel patched it on June 16. CISA added it to the Known Exploited Vulnerabilities catalog on September 21, and our own copy of that catalog carries the entry with the same date.

The new bug, CVE-2026-107441, is an out-of-bounds write in the same web interface. An unauthenticated attacker with network access can run operating system commands through crafted HTTP requests. Zyxel says the exploit also relied on missing validation of HTTP parameter lengths.

BleepingComputer, reading Binarly's work, reports the mechanism: the June patch added checks against buffer overflows, but an attacker could get around them by corrupting a parameter counter before it was validated. The new firmware limits parameter sizes and validates the parameter count before copying data into memory. Yegor Vasilenko of Binarly is credited on Zyxel's advisory.

The timeline, as reported

Everything in the table after the June patch comes from BleepingComputer's account. We confirmed the model table, fixed versions and credit on Zyxel's advisory itself. We could not read the body of Binarly's write-up, so the mechanism above is BleepingComputer's description of it.

Who and how many

GreyNoise, per BleepingComputer, reports a suspected Chinese-speaking actor it tracks as Kapibala compromised 996 devices across 48 countries. After access, the attackers ran commands and downloaded a script that collected device configurations, hashed root credentials and network information. GreyNoise links Kapibala to a campaign called Red Heron, which Acronis previously reported exploiting a critical Gitea flaw. Binarly found an exposed archive holding an obfuscated Python exploit while investigating Red Heron infrastructure tied to the JITTERLY backdoor and the SIXZUT rootkit.

What is not settled

Two things the sources leave open, and we would not paper over them.

First, which bug was used against the 996 devices. GreyNoise's September disclosure was attributed to CVE-2026-7273, the first bug. Binarly's exploit targeted firmware already patched for that one. BleepingComputer says it is unclear whether the exploit was built to bypass the earlier patches on purpose or targeted a related flaw those fixes missed. The headline calls the new bug a zero-day that was exploited; the body does not establish that CVE-2026-107441 itself is the one behind the 996. Treat both bugs as relevant until you have patched.

Second, no indicators. BleepingComputer's article lists no IP addresses, domains, hashes or file names, and we found none in the sources we could read. CVE-2026-107441 is not in our indexes or in CISA's catalog as we read it. So there is nothing to put in the feed from this story, and we are not going to invent a blocklist for it.

Which models, which firmware

Zyxel's advisory lists ten models. Affected means the listed version or earlier; the fixed version is in the right column.

Zyxel says models not in the table are unaffected.

What to do

Patch to the .3C0 build for your model. If a switch's management page can be reached from the internet, that is the larger problem: these are small-office and branch switches, and a management interface on the open internet turns a bug like this into a 996-device campaign. Take it off the internet, then patch.

If one was exposed during the window, assume the configuration file and the root credential hash were read. Change the credentials, rotate anything that was stored in the configuration, and review the configuration for changes. That is our inference from what the attackers reportedly collected, not a vendor instruction.

Limits

We read BleepingComputer's account, Zyxel's advisory for the new bug, and our own KEV copy. We did not read Zyxel's June advisory, GreyNoise's disclosure, or Acronis's Red Heron report, and Binarly's page body would not load for us. The 996, the 48 countries and the Kapibala attribution are GreyNoise's numbers as relayed by BleepingComputer. We did not run the exploit or test any device.

Five percent of this is wrong somewhere. It always is. The timeline rests on one relayed account until the primary write-ups are read.

Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.

---

Every indicator in this post is in the feed. Free.

1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.

Get your free key → analytics.dugganusa.com/stix/register