Zyxel Zero‑Day (CVE‑2026‑107441) Exploited to Compromise ~1,000 GS1900 Switches
What Happened — Zyxel disclosed a zero‑day out‑of‑bounds write flaw (CVE‑2026‑107441) in the web‑management interface of its GS1900 series switches. The vulnerability lets an unauthenticated network‑adjacent attacker execute OS commands via crafted HTTP requests. GreyNoise observed a Chinese‑language threat group, “Kapibala,” leveraging the bug from mid‑August 2026, compromising 996 devices in 48 countries, exfiltrating configuration files and hashed root credentials. The exploit bypassed an earlier patch (CVE‑2026‑7273) by corrupting a parameter counter before validation, meaning all firmware releases that addressed the prior issue remained vulnerable. Zyxel issued patches on 22 Oct 2026 and a security advisory on 3 Nov 2026, but the zero‑day remained unpatched until the new update.
Why It Matters for Trust & Control Assurance — The incident highlights the critical need for continuous vulnerability management and verifiable patch evidence, a control that maps to dozens of compliance frameworks at once.
Who Is Affected — Enterprises and service providers that deploy Zyxel GS1900 switches (network‑infrastructure vendors, data‑center operators, telecoms, manufacturing sites).
Recommended Actions —
- Inventory all GS1900 devices and verify firmware version against Zyxel’s advisory.
- Apply the latest Zyxel patch immediately; enable automatic update where possible.
- Integrate vulnerability‑scan results into a continuous control‑evidence repository to demonstrate timely remediation.
Technical Notes —
- Attack vector: unauthenticated HTTP request exploiting an out‑of‑bounds write in the web UI.
- CVE: CVE‑2026‑107441 (out‑of‑bounds write, CVSS ≈ 9.8).
- Related CVE: CVE‑2026‑7273 (buffer overflow, previously patched).
- Threat actor: Kapibala, linked to the Red Heron campaign.
- Impact: theft of switch configs, hashed root credentials, network topology data.
Source: BleepingComputer