Zyxel patches a GS1900 switch zero-day that was used to compromise nearly 1,000 devices

Zyxel has patched CVE-2026-107441, a zero-day vulnerability in its GS1900 series network switches that attackers used to compromise nearly 1,000 devices worldwide and steal configuration files and credentials. BleepingComputer reports that the flaw is an out-of-bounds write in the switches' web management interface. It lets an unauthenticated attacker with network access run operating system commands through specially crafted HTTP requests. Ten GS1900 models are affected. Zyxel released security updates on October 22 and published an advisory on November 3. The attacks were at first attributed to CVE-2026-7273, a pre-authentication buffer overflow in the same switches that Zyxel patched on June 16. The Hacker News reports that this earlier patch did not block the zero-day exploit. From around August 17, the security firm GreyNoise observed a suspected Chinese-speaking threat actor it tracks as Kapibala exploiting the switches. GreyNoise says the attackers compromised 996 devices in 48 countries, ran commands remotely, and downloaded a script that collected device configurations, hashed root credentials and network information. GreyNoise linked Kapibala to the Red Heron hacking group. Organizations that run GS1900 switches and installed only the June update may still have been exposed. The theft of credentials and configurations may mean they need to do more than install the new firmware.