Hackers Exploit Zyxel GS1900 Zero-Day in the Wild to Hijack Network Switches

A flaw in Zyxel GS1900 switches was already being used by hackers, and the patch meant to fix it did not work. Researchers at Binarly found that a public exploit hit a different bug than the one Zyxel had patched. Zyxel has now confirmed it as a new flaw, tracked as CVE-2026-107441.

Zyxel published its fix for CVE-2026-7273 on June 16, 2026. After GreyNoise reported real attacks in September, Binarly tested all ten fixed firmware releases on September 28 and found every one still open. Zyxel confirmed the new bug on October 11, shipped a fix on October 22, and published its advisory on November 3.

The flaw sits in the dispatcher.cgi web program. It carries a 9.8 critical score, and an attacker can run commands as root without logging in. The same weak code also exists in httprestorecfg.cgi and httpupload.cgi.

Zyxel GS1900 Zero-Day Exploited

The switch web page stores request parameters in a fixed memory block of 140 slots. Each slot holds 1,024 bytes. The code copies the data first and checks the count afterward. A long value in slot 139 spills over and overwrites the counter itself.

An attacker can set the counter to a negative number and write to memory before the block. This lets them overwrite function pointers and run their own commands. Zyxel’s patch added a count check, but the bad copy still happens before that check runs.

Binarly also says Zyxel described the bug wrongly. The flaw lives in global memory, not on the stack. It also works over normal HTTP from any network that can reach the switch, so Binarly rates it higher than the 8.8 score Zyxel gave.

GreyNoise says one actor hit 996 GS1900 switches in 48 countries around August 17. The actor stole device settings, hashed root passwords, and network details. A total of 564 of those switches still used factory default logins. Italy, the United States, and Taiwan had the most victims.

The exploit was a Python script hidden with PyArmor. It pulled a collector script from the attacker’s server using TFTP, then copied the stolen data to a web-readable folder. GreyNoise ties the actor to the Gitea campaign that Acronis called Red Heron, based on shared servers and malware.

That campaign used JITTERLY, a Linux backdoor with more than 30 commands. It hides a rootkit called SIXZUT inside itself, which can conceal files, processes, and network links. Binarly found its samples while checking this server for Binarly Transparency Platform detections.

CISA added CVE-2026-7273 to its Known Exploited Vulnerabilities list on September 21. Our earlier report on the CISA warning for Zyxel GS1900 switches covers that step. Binarly now says either Zyxel’s first patch was wrong, or the attacks hit a different bug than CISA named. Either way, the flaw in Binarly’s advisory is present in the ten releases sold as fixes.

The same actor also broke into WordPress sites, as our story on hackers exploiting WordPress flaws to steal government records shows. GreyNoise counted more than 18,000 stolen records in one case.

Update every GS1900 switch to the October 22 fix or newer from Zyxel. Take web management pages off the internet and limit them to trusted admin networks. Change all default passwords right away.

CISA also tells teams to check devices for odd admin activity, changed settings, and strange web requests. Because attackers took hashed root credentials, treat any exposed switch as possibly stolen and rotate its passwords.

Indicators of Compromise

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hackers Exploit Zyxel GS1900 Zero-Day in the Wild to Hijack Network Switches appeared first on Cyber Security News.