Zyxel has fixed a previously unknown flaw in its GS1900 network switches that attackers used to compromise nearly 1,000 devices after a June patch for a related bug failed to stop them, BleepingComputer reported Wednesday. The case shows that equipment listed as patched, even against a flaw the federal government had flagged as exploited, can remain open to attack.
What Happened
The new flaw, tracked as CVE-2026-107441, is an out-of-bounds write, a bug that lets an attacker write data past the memory a program set aside for it. In its Nov. 3 security advisory, Zyxel said an attacker with network access, without logging in, could send a crafted web request to the switch’s management software and potentially run operating system commands. Ten GS1900 models are affected, all listed in the advisory.
Threat intelligence firm GreyNoise saw attacks begin around Aug. 17 and counted 996 compromised devices in 48 countries, BleepingComputer reported. On Sept. 21, GreyNoise blamed the campaign on CVE-2026-7273, an older flaw Zyxel had patched June 16, and the Cybersecurity and Infrastructure Security Agency (CISA) added that bug to its list of known exploited vulnerabilities the same day.
Firmware security firm Binarly then obtained the attackers’ exploit and confirmed Sept. 28 that it still worked on all ten firmware releases patched in June. Zyxel confirmed a separate flaw Oct. 11 and shipped fixed firmware Oct. 22, according to BleepingComputer. Binarly found the June patch’s overflow checks could be bypassed by corrupting a count of request parameters before it was checked.
Once inside, the attackers ran a script that collected device settings, hashed root credentials and network details, BleepingComputer reported. GreyNoise links the activity to a suspected Chinese-speaking group it tracks as Kapibala and ties it to a campaign called Red Heron. That attribution is vendor research and has not been confirmed by a government.
Why It Matters
Organizations that applied the June fix on CISA’s orders had good reason to think they were protected. Binarly argued that advisories and version numbers cannot be fully trusted, SecurityWeek reported. Leaders should ask teams to look for signs of compromise on edge devices, such as configuration changes nobody made, rather than only confirming a version number. Any switch that may have been reached should get new administrator passwords, and switch management pages should not be reachable from the internet.
What to Watch
Neither BleepingComputer nor SecurityWeek reported whether CISA plans to list the new flaw. Another open question is how many compromised switches sit in U.S. networks.
