A zero-day vulnerability in Zyxel GS1900 network switches can let an unauthenticated attacker execute operating system commands, even on devices updated with the company's June security patch. The flaw, CVE-2026-107441, affects 10 switch models and has now been addressed with a second firmware update.
The problem extends beyond a theoretical exploit. Security researchers linked the attack technique to a campaign that compromised 996 switches across 48 countries. Administrators who installed the earlier update for CVE-2026-7273 must check their firmware again.
Why the June Zyxel patch failed
Zyxel released firmware updates on June 16 to address CVE-2026-7273, a buffer overflow vulnerability in the GS1900 series' web-management software.
However, researchers at Binarly subsequently discovered that the exploit circulating against these switches still worked against the patched firmware.
The problem involved how the management interface processed HTTP request parameters. The software stored parameters in a fixed-size memory area but failed to properly validate their lengths before copying them.
The June patch introduced a parameter-count check, but it ran too late. An oversized parameter could overwrite the counter before the validation occurred, allowing an attacker to corrupt memory and redirect program execution.
Binarly reported the finding to Zyxel on Sept. 29. Zyxel classified the missing parameter-length validation as a separate vulnerability, CVE-2026-107441.
According to Zyxel's Nov. 3 security advisory, the flaw could allow a LAN-based attacker without credentials to execute OS commands through a crafted HTTP request.
Zyxel assigned the vulnerability a CVSS score of 8.8, while Binarly rated it 9.8 and reported that successful exploitation could provide root-level command execution.
The new Patch 3 firmware addresses the underlying issue by validating parameter counts before copying data and limiting parameter sizes.
Nearly 1,000 Zyxel switches compromised
The vulnerability was associated with an attack campaign already underway before researchers disclosed the problem.
In September, GreyNoise reported that a threat actor it tracks as Kapibala had compromised 996 GS1900 switches across 48 countries, beginning around Aug. 17.
Attackers downloaded a data-collection script that gathered switch configurations, hashed root credentials, and network information.
Of the compromised switches, 564 reportedly still used factory-default credentials, creating an additional security concern.
Binarly later discovered a working exploit on infrastructure associated with the JITTERLY backdoor. Its analysis established that the exploit could bypass the June firmware fix.
The investigation does not establish how many of the compromised devices have since been cleaned or updated.
Attackers have also targeted other network management systems. Recent Cisco SD-WAN attacks involved malware designed to collect encryption key material, while a separate Arista VeloCloud vulnerability allowed attackers to gain privileged operator access.
Which Zyxel GS1900 models need Patch 3?
Zyxel identifies 10 affected models. All require their corresponding firmware version ending in .3)C0.
- GS1900-8: 2.90(AAHH.3)C0
- GS1900-8HP: 2.90(AAHI.3)C0
- GS1900-10HP: 2.90(AAZI.3)C0
- GS1900-16: 2.90(AAHJ.3)C0
- GS1900-24: 2.90(AAHL.3)C0
- GS1900-24E: 2.90(AAHK.3)C0
- GS1900-24EP: 2.90(ABTO.3)C0
- GS1900-24HPv2: 2.90(ABTP.3)C0
- GS1900-48: 2.90(AAHN.3)C0
- GS1900-48HPv2: 2.90(ABTQ.3)C0
For each model, the corresponding Patch 2 build ending in .2)C0, and all earlier versions, remain vulnerable.
Zyxel says currently marketed products outside the affected-model list are not vulnerable to this flaw.
What administrators should do now
Organizations running affected GS1900 switches should install the model-specific Patch 3 firmware immediately. The updates were released in October, ahead of Zyxel's Nov. 3 advisory.
Administrators should also:
- Check firmware versions: Confirm that every affected switch runs the correct Patch 3 build.
- Restrict management access: Prevent untrusted networks and internet hosts from reaching the web-management interface.
- Rotate credentials: Replace default passwords and change credentials potentially exposed during the attack campaign.
- Review configurations: Compare switch settings against known-good backups and investigate unauthorized changes.
- Check for compromise: Examine available network logs and indicators associated with the Kapibala campaign.
Devices exposed to untrusted networks during the exploitation period deserve additional investigation. Installing new firmware closes the vulnerability but does not automatically reverse an earlier compromise.
CISA added the earlier CVE-2026-7273 to its Known Exploited Vulnerabilities catalog in September. As of Nov. 4, the newer CVE-2026-107441 had not been added. Other recent CISA additions have included actively exploited vulnerabilities affecting SonicWall and enterprise infrastructure.
Organizations that already completed the earlier CISA-mandated remediation should therefore verify their firmware independently rather than relying on the previous patch record.
Also read: Attackers targeted a critical SonicWall vulnerability just two days after its disclosure, with researchers recording 135 exploitation attempts.