The June patch left Zyxel network switches open to hackers

While digging through a hacking group's infrastructure, researchers at Binarly came across an archive left publicly accessible. Inside was a deliberately obfuscated Python program, written to attack Zyxel GS1900-series network switches. These are small boxes that connect the computers in an office or an SME.

On November 3, Zyxel published a security advisory on the corresponding vulnerability, CVE-2026-107441. It is an out-of-bounds memory write in the program that runs the switch's web interface. It could allow an attacker on the local network, without a password, to run commands on the device by sending a crafted request. Ten models are affected. According to BleepingComputer, the patched firmware has been available since October 22.

A June patch that did not close the door

The story begins with a misunderstanding. The attack was first linked to another vulnerability, CVE-2026-7273, which Zyxel had patched on June 16. But on September 28, Binarly found that the program still worked against all ten versions supposed to be protected. According to BleepingComputer, the June patch did add checks against memory overflows. Attackers could still bypass them by falsifying a parameter counter before the check. Binarly alerted Zyxel on September 29, and the vendor confirmed the problem on October 11.

The new firmware limits the size of parameters and checks their number before copying them into memory. One question remains unanswered: was the attack designed to defeat the June patch, or did it target a neighboring flaw that this patch overlooked?

Nearly 1,000 devices hacked in 48 countries

The threat is far from theoretical. GreyNoise, a company that monitors malicious traffic on the Internet, saw the first attacks around August 17 and made them public on September 21. It attributes them to a group it suspects is Chinese-speaking and has nicknamed Kapibala. It counts 996 compromised devices in 48 countries. Once in control, the hackers downloaded a script that collected the switch's configuration, the hash of the administrator password and information about the network. GreyNoise links this group to the Red Heron campaign, already described by Acronis. On that same September 21, the US cybersecurity agency CISA added CVE-2026-7273 to its catalog of actively exploited vulnerabilities.

The scenario is reminiscent of Fortinet, where a flaw patched in April was used to hide an implant in firewalls: network equipment that is reportedly up to date is not necessarily protected.

The versions to install, even after the June update

The vulnerable firmware versions are 2.90(…2)C0 and earlier. Here are the patched versions listed by Zyxel:

• GS1900-8: 2.90(AAHH.3)C0;
• GS1900-8HP: 2.90(AAHI.3)C0;
• GS1900-10HP: 2.90(AAZI.3)C0;
• GS1900-16: 2.90(AAHJ.3)C0;
• GS1900-24: 2.90(AAHL.3)C0;
• GS1900-24E: 2.90(AAHK.3)C0;
• GS1900-24EP: 2.90(ABTO.3)C0;
• GS1900-24HPv2: 2.90(ABTP.3)C0;
• GS1900-48: 2.90(AAHN.3)C0;
• GS1900-48HPv2: 2.90(ABTQ.3)C0.

Zyxel only provides patches for models still covered by its security support. Beyond the update, a few good practices:

• restrict the administration interface to a separate management network and never expose it on the Internet;
• change the administrator password after the update, since the hackers were retrieving its hash;
• check that the switch's configuration has not been modified;
• replace models that no longer receive patches.

It remains to be seen whether CISA will add the new vulnerability to its catalog, which would officially confirm that it is being exploited.