Zyxel has fixed a zero-day vulnerability in its GS1900 series network switches after attackers used it to break into nearly 1,000 devices in 48 countries and steal configuration files and credentials. The flaw, tracked as CVE-2026-107441, survived an earlier patch that was supposed to close the hole.

The vulnerability is an out-of-bounds write flaw in the switches' web management interface. An attacker with network access and no login credentials could send specially crafted HTTP requests and run operating system commands on the device. Zyxel rates the flaw at 8.8 out of 10 for severity, while firmware security firm Binarly, which found the problem, rated it 9.8 and said successful exploitation could give root-level command execution.

Attacks began in August

Cybersecurity company GreyNoise first spotted the attacks in mid-August. From around 17 August, a suspected Chinese-speaking threat actor it tracks as Kapibala exploited the switches, compromising 996 devices across 48 countries. Italy, the United States and Taiwan were among the hardest-hit locations.

The attackers harvested switch configurations, hashed root credentials and network information. GreyNoise also found that 564 of the compromised switches were still running factory-default credentials, meaning their owners had never changed the password the device shipped with.

Researchers later linked the campaign to variants of the JITTERLY backdoor and the SIXZUT rootkit, malware previously tied to attacks on Gitea code-hosting servers.

June patch did not stop the attacks

The incident is a cautionary tale about incomplete fixes. On 16 June, Zyxel released firmware updates for a different flaw in the same switches, CVE-2026-7273, a pre-authentication buffer overflow. When GreyNoise reported the compromise campaign in September, the attacks were at first blamed on that older flaw.

But Binarly, investigating infrastructure linked to the JITTERLY backdoor, recovered the actual exploit and found it targeted a separate, previously unknown vulnerability that the June patch had not fixed. Binarly confirmed on 28 September that the exploit still worked against all ten firmware releases patched for the June flaw.

Binarly reported its findings to Zyxel on 29 September. Zyxel confirmed the new vulnerability on 11 October and assigned it the identifier CVE-2026-107441.

What switch owners should do now

Zyxel released new firmware updates in late October that limit parameter sizes and check parameter counts before data is copied into memory, blocking the exploitation technique. It published a public security advisory on 3 November. Ten GS1900 switch models are affected, and administrators should install the latest firmware for their model.

Security researchers also advise taking the switches' web management interface off the public internet wherever possible, and changing any factory-default credentials. The earlier flaw, CVE-2026-7273, was added to the US Cybersecurity and Infrastructure Security Agency's known-exploited-vulnerabilities catalogue in September.

Anyone running a GS1900 switch should check Zyxel's advisory for their exact model and firmware version, and treat any device that was exposed to the internet before the October update as potentially compromised.