Zyxel GS1900 Switch Zero-Day Was Used to Break Into 996 Switches, and the June Patch Does Not Stop It

Zyxel has fixed a zero-day flaw in its GS1900 series managed network switches that attackers used to break into nearly 1,000 switches around the world and steal their configuration files and passwords. A zero-day is a flaw that attackers use before the vendor has a fix. The important detail for owners is that many sites already thought they were protected. The attacks were first blamed on an older flaw that Zyxel had patched in June, but researchers later showed that the attack still worked on switches running that June update.

What Zyxel published

On 3 November 2026, Zyxel published a security advisory for CVE-2026-107441, an out-of-bounds write flaw in the program behind the switch's web management page. An out-of-bounds write means the software writes data past the end of the memory set aside for it, which can let an attacker run their own commands. Zyxel says an attacker on the local network, with no login, could use a specially crafted web request to run operating system commands on the switch. Zyxel rates it 8.8 out of 10, High, on the Common Vulnerability Scoring System (CVSS).

Ten models are affected: GS1900-8, GS1900-8HP, GS1900-10HP, GS1900-16, GS1900-24, GS1900-24E, GS1900-24EP, GS1900-24HPv2, GS1900-48 and GS1900-48HPv2. Every affected model needs firmware version 2.90 build ".3" or later, for example 2.90(AAHH.3)C0 for the GS1900-8 and 2.90(AAHL.3)C0 for the GS1900-24. Zyxel's advisory lists the exact fixed version for each model. BleepingComputer reports that the fixed firmware was released on 22 October.

How the attacks unfolded

BleepingComputer reports the following sequence, based on findings from the security firms GreyNoise and Binarly:

• On 16 June 2026, Zyxel fixed CVE-2026-7273, a buffer overflow in the same GS1900 switches.
• Starting around 17 August, GreyNoise saw a threat actor it tracks as Kapibala, which it describes as a suspected Chinese-speaking group, break into 996 switches in 48 countries. The attackers ran commands remotely, then downloaded a script that collected the switch configuration, the hashed root password (the password for the all-powerful account, stored in scrambled form) and network details.
• On 21 September, GreyNoise disclosed the campaign and blamed CVE-2026-7273. The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-7273 to its Known Exploited Vulnerabilities (KEV) catalog the same day.
• Binarly later found the attacker's exploit and confirmed on 28 September that it still worked against every firmware release that had been patched for CVE-2026-7273. Zyxel confirmed the new flaw on 11 October and assigned it CVE-2026-107441.

GreyNoise links Kapibala to a wider campaign called Red Heron, which the security firm Acronis previously reported was exploiting a flaw in Gitea, a self-hosted code repository service. As of 4 November 2026, CVE-2026-107441 itself is not in the KEV catalog, but the attacks that prompted it are the same ones CISA already listed under the older number.

Why this matters for plants

Small managed switches like the GS1900 are common in places that do not always get the attention of the main network: pump stations, lift stations, water plants, remote substations, packaging lines and control panels put together by integrators. They are often set up once and then left alone for years. A switch that an attacker controls can copy traffic, change virtual local area networks (VLANs, the settings that keep the control network apart from everything else) or be used as a quiet foothold to reach programmable logic controllers (PLCs) and human-machine interfaces (HMIs) on the same network. Because the attackers took configuration files and password hashes, a switch that was compromised and then patched may still have exposed passwords that are reused on other switches or devices.

Where it shows up, plant floor to cloud

On the plant floor, GS1900 switches connect controllers, drives, operator panels and cameras inside cabinets and remote sites. In the control room and supervisory network, they may link supervisory control and data acquisition (SCADA) servers, historians and engineering workstations. At the business edge and in branch offices, the same models connect office networks, and their web management page is sometimes reachable from the business network or even the internet, which is where an attacker reaches it first.

What owners should do now

1. Find every Zyxel GS1900 switch you own, including ones inside integrator panels and at remote sites, and record its model and firmware version.
2. Upgrade each one to the fixed firmware Zyxel lists for that model, even if you already installed the June update for CVE-2026-7273. That June update does not stop this attack.
3. Treat any switch whose management page was reachable from the internet or the business network as possibly compromised. Compare its current configuration with a known good copy, change the admin password and any password stored in the configuration, and do not reuse those passwords on other devices.
4. Limit who can reach switch management. Turn off web management where you do not need it, and allow it only from a management network or jump host, which is a single hardened computer used for administration.

Red Tiger Security has completed 500+ plant-safe operational technology (OT) assessments and trained 4,500+ engineers and operators. Our team can help you build an inventory of the network gear inside your plants and remote sites, find management interfaces that are exposed where they should not be, and set up 24x7 monitoring that flags configuration changes on your switches.

We are here to help, so check out our resources online at www.redtigersecurity.com and book a follow-up call with our team if you have any questions: https://calendly.com/jonathanpollet/30min

Sources

Zyxel, "Zyxel security advisory for out-of-bounds write vulnerability in GS1900 series switches," 3 November 2026: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026

BleepingComputer, "Zyxel fixes zero-day exploited to hack nearly 1,000 network switches," 4 November 2026: https://www.bleepingcomputer.com/news/security/zyxel-fixes-zero-day-exploited-to-hack-nearly-1-000-network-switches/

Zyxel, security advisory for CVE-2026-7273 in GS1900 series switches, 16 June 2026: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-stack-based-buffer-overflow-vulnerability-in-gs1900-series-switches-06-16-2026

Binarly, research on CVE-2026-107441 (supporting): http://www.binarly.io/blog/zyxel-gs1900-rce-cve-2026-107441

CISA Known Exploited Vulnerabilities catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

‍