“The attackers compromised 996 devices across 48 countries.” That stark figure, reported by GreyNoise, is the clearest measure of a months‑long intrusion campaign that hinged on a previously unknown weakness in Zyxel GS1900 network switches and on a mistaken attribution that delayed a corrective response.
CVE-2026-107441: an out‑of‑bounds write in the GS1900 web interface
Zyxel confirmed a zero‑day vulnerability in its GS1900 series switches and assigned it CVE-2026-107441. The flaw is an out‑of‑bounds write in the switches’ web management interface that allows an unauthenticated attacker with network access to execute operating‑system commands by sending specially crafted HTTP requests. Zyxel said the defect affects ten GS1900 switch models and that the new firmware updates released on October 22 limit parameter sizes and validate the parameter count before copying data into memory to prevent the exploitation technique.
How the compromise unfolded: Kapibala, Red Heron, and the payload
Beginning around August 17, GreyNoise observed a suspected Chinese‑speaking threat actor tracked as Kapibala exploiting Zyxel switches. GreyNoise reported that the attackers compromised 996 devices across 48 countries. The exploit enabled remote command execution and was used to download a script that collected device configurations, hashed root credentials, and network information. GreyNoise linked Kapibala to the Red Heron campaign, a series of intrusions previously tied to exploitation of a critical vulnerability in self‑hosted Gitea, according to Acronis.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildMisattribution and the role of earlier patches (CVE-2026-7273)
On June 16, Zyxel released security updates addressing CVE-2026-7273, a pre‑authentication buffer‑overflow vulnerability affecting the same GS1900 switches. When GreyNoise publicly disclosed the campaign on September 21, it attributed the exploitation to CVE-2026-7273 — and that same day CISA added CVE-2026-7273 to its Known Exploited Vulnerabilities catalog, requiring federal agencies to address the flaw. Subsequent research, however, showed the exploit in the wild targeted a separate vulnerability that remained unpatched.
Binarly’s forensic discovery and the technical bypass
Firmware security researchers at Binarly traced Red Heron infrastructure tied to the JITTERLY backdoor and the SIXZUT rootkit and discovered an exposed archive containing an obfuscated Python exploit targeting Zyxel GS1900 switches. Their analysis revealed the exploit explicitly checked for firmware versions patched for CVE-2026-7273, indicating the exploit had been developed or updated with those checks in mind. On September 28 Binarly confirmed the exploit remained effective against all ten firmware releases that Zyxel had patched for CVE-2026-7273.
Binarly determined that the earlier June update had added safeguards preventing the buffer overflow, but the exploit bypassed those checks by corrupting a parameter counter before it was validated. Corrupting that counter let the exploit overwrite memory and execute commands without authentication, even on switches that had received the June fixes. Binarly reported its findings to Zyxel on September 29; Zyxel confirmed the new vulnerability on October 11 and assigned it CVE-2026-107441.
What this means for administrators, CISA, and threat hunters
- Administrators of affected Zyxel GS1900 switches: install the October 22 firmware updates immediately. Zyxel’s fixes limit parameter sizes and validate parameter counts to block the exploitation technique tied to CVE-2026-107441.
- CISA and federal IT teams: a previously catalogued CVE (CVE-2026-7273) was initially blamed for these intrusions and was added to the Known Exploited Vulnerabilities catalog on September 21; the later discovery of CVE-2026-107441 shows rapid re‑assessment of exploited flaws may be necessary when exploit code checks or bypasses earlier mitigations.
- Threat hunters and incident responders: the campaign demonstrates how exploit code can be modified to detect and evade patches (the recovered exploit checked for firmware patched for CVE-2026-7273), underscoring the value of analyzing recovered exploit archives and firmware to separate true root causes from apparent attributions.
The public record for this campaign is tightly drawn: attackers used a web‑interface out‑of‑bounds write to seize nearly a thousand switches, initial attribution to a patched buffer overflow proved incomplete, and a second, previously unknown vulnerability — CVE-2026-107441 — ultimately explained why devices remained vulnerable even after the June updates. Zyxel’s October 22 firmware and the November 3 security advisory close the technical gap; the remaining question, left in the vendor and researcher statements, is whether the exploit was deliberately crafted to bypass the June fixes or simply capitalized on a related validation gap the earlier patches did not address.
Link to the original story: https://www.bleepingcomputer.com/news/security/zyxel-fixes-zero-day-exploited-to-hack-nearly-1-000-network-switches/
