Zyxel GS1900 series switches exploited to steal credentials via CVE-2026-107441
TL;DR
Zyxel has patched a zero-day vulnerability, CVE-2026-107441, in its GS1900 series network switches. Attackers exploited this flaw to compromise 996 devices across 48 countries, stealing configurations and hashed root credentials. Update your firmware immediately to the latest version provided by Zyxel.
What happened
A zero-day vulnerability in the web management interface of Zyxel GS1900 series switches has been exploited by a threat actor tracked as Kapibala. The flaw, CVE-2026-107441, is an out-of-bounds write that allows an unauthenticated attacker with network access to execute operating system commands via specially crafted HTTP requests.
The attacks were initially mistaken for an older vulnerability, CVE-2026-7273, which Zyxel had patched on June 16, 2026. However, researchers at Binarly discovered that the new exploit specifically targeted and bypassed the security checks introduced in those previous updates. The attackers used the flaw to download scripts that collected device configurations, network information, and hashed root credentials. Kapibala is linked to the Red Heron hacking campaign. Zyxel released security updates to address this new flaw on October 22, 2026.
Why it matters
This is a critical failure of previous remediation efforts. The exploit was specifically engineered to bypass the patches Zyxel released in June, meaning even "updated" systems remained vulnerable. Because the flaw allows unauthenticated remote code execution, any attacker with LAN access can take full control of the switch. For organizations relying on these devices for network infrastructure, the theft of hashed root credentials and configuration files provides a roadmap for further lateral movement and persistent access within the network.
Who is affected
The following GS1900 models and versions are vulnerable:
| Affected Model | Vulnerable Versions |
|---|---|
| GS1900-8 | 2.90(AAHH.2)C0 and earlier |
| GS1900-8HP | 2.90(AAHI.2)C0 and earlier |
| GS1900-10HP | 2.90(AAZI.2)C0 and earlier |
| GS1900-16 | 2.90(AAHJ.2)C0 and earlier |
| GS1900-24 | 2.90(AAHL.2)C0 and earlier |
| GS1900-24E | 2.90(AAHK.2)C0 and earlier |
| GS1900-24EP | 2.90(ABTO.2)C0 and earlier |
| GS1900-24HPv2 | 2.90(ABTP.2)C0 and earlier |
| GS1900-48 | 2.90(AAHN.2)C0 and earlier |
| GS1900-48HPv2 | 2.90(ABTQ.2)C0 and earlier |
What to do now
- Install the latest firmware specific to your model (e.g.,
2.90(AAHH.3)C0for the GS1900-8) immediately. - Rotate all credentials, including root passwords and any secrets contained within network configuration files.
- Monitor network logs for unauthorized or unusual HTTP requests directed at the switch web management interface.
What we don't know yet
- Whether the exploit was intentionally designed to bypass the June 2026 patches or if it exploited a different, related flaw.
- The total volume and specific sensitivity of the data stolen from the 996 compromised devices.
Sources
- bleepingcomputer.comhttps://www.bleepingcomputer.com/news/security/zyxel-fixes-zero-day-exploited-to-hack-nearly-1-000-network-switches/
- zyxel.comhttps://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026
- zyxel.comhttps://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-stack-based-buffer-overflow-vulnerability-in-gs1900-series-switches-06-16-2026
- acronis.comhttps://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/
