Zyxel GS1900: CVE-2026-107441, 996 switches

Zyxel has new firmware for its GS1900 switches because a zero-day was already in use. GreyNoise counted 996 compromised devices across 48 countries. The operators walked away with configuration files, hashes of the root credential, and a map of the networks those switches serve. Zyxel shipped the fix on October 22 and published the advisory on November 3, under CVE-2026-107441.

The flaw sits in the web management interface. Someone who can reach that page, with no account on the switch, can run commands on the device. Ten GS1900 models are in the affected set. The defender detail is the firmware date. The rest of the bug write-up can stay in the advisory.

The June package closed a different CVE

On June 16, 2026, Zyxel patched CVE-2026-7273, an earlier pre-authentication flaw on the same GS1900 family. GreyNoise dates the later campaign to about August 17. It tracks the operator as Kapibala, describes the cluster as likely Chinese-speaking, and links the activity to a campaign known as Red Heron. Acronis has previously tied Red Heron to attacks on the self-hosted Git service Gitea.

GreyNoise’s September 21 write-up named CVE-2026-7273. CISA added that identifier to the Known Exploited Vulnerabilities catalog the same day, and federal teams went after the June firmware.

Firmware firm Binarly, following Red Heron infrastructure, found an exploit aimed at the GS1900 that still succeeded on all ten firmware builds carrying the June fix. Binarly told Zyxel on September 29. Zyxel confirmed a separate vulnerability on October 11 and assigned CVE-2026-107441. The October 22 firmware is the release that closes it. Zyxel has left open whether the exploit was built to step past the June package or simply hit a neighboring flaw that package never covered. For anyone running the switches, both readings end in the same place: a GS1900 that only has the June update is still inside the campaign’s reach.

What to do with a GS1900

Install the October 22 firmware, or any newer Zyxel build published for CVE-2026-107441, on every GS1900 model in the fleet. Record the build string. A note that says “Zyxel patched” is how the June ticket got closed on the wrong CVE. Switches that already took the CVE-2026-7273 update still need this second package. Where a KEV item was marked done on the June identifier alone, open it again.

Remove the web management interface from the public internet. The flaw requires no login for anyone who can open that page. Keep management on a network ordinary switch users cannot reach, and prefer a brokered vendor session over a port forward.

Assume the stolen configs are a map the operator kept. The root credential hashes left with them. Rotate local accounts on every GS1900 that was online from mid-August through the October update, and rotate any password, SNMP community, or other secret that lived in the running config and is reused somewhere else. A hash taken in August still matters in November if that secret never changed.

Review management sessions the site did not initiate, especially from August 17 onward, and any account or firmware change in that window. GreyNoise’s figure is 996 devices. A switch that looks quiet can still be one of them when the only check was the June advisory.

The campaign’s head start was a mislabeled CVE. The close is the October firmware, plus a credential rotation that assumes the config already left the building.

This briefing relies on public reporting by BleepingComputer and on advisories and research from Zyxel, GreyNoise, Binarly, and CISA. It does not include exploit procedures.