Zyxel zero-day hit 996 switches, researchers say — and the June patch never stopped it
Attackers exploited a flaw in Zyxel's GS1900 switches for months — and the June patch everyone blamed the attacks on never covered it. About 996 switches across 48 countries were hit, researchers say.
The News
Zyxel has published an advisory for a serious flaw in its GS1900 series network switches — the boxes that connect computers, printers and other devices inside offices and small businesses. The flaw, tracked as CVE-2026-107441, is an out-of-bounds write in the switches' web management interface: the software writes data past the edge of the memory space it was given, which an attacker can exploit to run their own commands on the device. No username or password is needed. Zyxel published the advisory on November 3.
The flaw was already being exploited before Zyxel knew about it — what the industry calls a zero-day, a vulnerability attackers find and use before the maker has a fix. Researchers at Binarly say the flaw was exploited from around August 17 against roughly 996 switches across 48 countries, in a campaign attributed to a Chinese-speaking actor tracked as Kapibala and linked to the Red Heron campaign. Attackers collected device settings and hashed root credentials — scrambled versions of the master passwords. GreyNoise found that 564 of the 996 compromised switches still had their factory-default credentials: the passwords they shipped with, never changed.
The detail that makes this story is the patch that did not work. Attacks were first blamed on a different flaw, CVE-2026-7273, which Zyxel patched in June. But Binarly found the exploit actually targeted this separate, unpatched flaw, so the June patch never stopped it. Ten GS1900 models running firmware 2.90 Patch 2 or earlier are affected — firmware is the permanent software built into a device — and the fix is version 2.90 Patch 3, released October 22–23. Zyxel rates the flaw 8.8 out of 10 for severity; Binarly rates it 9.8. Canada's Centre for Cyber Security said in an alert updated November 4 that open-source reporting indicates the flaw is being exploited in the wild, though Zyxel's own advisory does not itself claim exploitation. One caveat: the 996-switch count comes from Binarly and GreyNoise reporting, not from Zyxel — Zyxel has not confirmed it.
The June patch never stopped it — the exploit targeted a separate, unpatched flaw.
Why It Matters
Switches are the quiet plumbing of a network. They sit in offices, schools and small businesses, routing traffic between devices, and nobody thinks about them until something goes wrong. That is exactly what makes them attractive targets: they are rarely patched, rarely monitored and often still running the password printed on the box. An attacker who controls a switch can watch the traffic passing through it and use it as a stepping stone into the rest of the network.
The patch-bypass detail is the lesson for the whole industry. When attacks were blamed on the June flaw, anyone who had installed the June patch reasonably believed they were safe. The real flaw was different, unpatched and still being exploited. It is a reminder that a patch only protects you if it fixes the hole the attacker is actually using — and that finding out which hole that is can take months, during which the attacks do not stop.
Analyst's Take
Our call is Mixed. The worst part of this story is not the flaw itself — flaws happen — but the months in which everyone believed the June patch had fixed the problem while attacks continued through a different hole: the June patch went out on June 16 and the real fix did not arrive until October 22. That is a failure of diagnosis, and it left roughly a thousand switches exposed, more than half of them still running the passwords they shipped with. A switch that an attacker controls is a foothold inside a network, and from there the attacker can watch traffic, steal credentials and move deeper.
What to watch: whether Zyxel confirms the scale of the compromise, whether more victims surface now that the real flaw is public, and whether the Kapibala campaign turns up in other devices. For CrowdStrike and Palo Alto Networks, the read-through is familiar: every incident like this is a sales pitch for detection tools — but the lesson that matters is the boring one. Change the default password, and update the firmware. More than half of the victims in this campaign had done neither.
Are you bullish or bearish on this story?
By The Numbers
FAQ
What is a zero-day?
A flaw that attackers find and use before the maker knows about it — so there is no fix available on day zero, when the attacks begin. The Zyxel flaw was exploited from around August 17, weeks before Zyxel published its advisory on November 3.
Why didn't the June patch stop the attacks?
Because the attacks were blamed on the wrong flaw. Zyxel patched CVE-2026-7273 in June, but researchers at Binarly found the exploit actually targeted a separate, unpatched flaw, CVE-2026-107441. Fixing one hole does not help when the intruder is coming through another one.
Which devices are affected and what is the fix?
Ten GS1900 models running firmware 2.90 Patch 2 or earlier — firmware is the permanent software built into a device. The fix is version 2.90 Patch 3, released October 22–23. Anyone still running the older firmware should update.
How bad is the flaw?
Zyxel rates it 8.8 out of 10 for severity; Binarly rates it 9.8. An attacker needs no username or password to run commands on an affected switch, and attackers collected device settings and scrambled versions of the master passwords.
Is the 996-switch figure confirmed?
No — not by Zyxel. The count comes from reporting by Binarly and GreyNoise, and Zyxel has not confirmed it. What is confirmed is the flaw itself, the affected models and the fix. Canada's Centre for Cyber Security says open-source reporting indicates the flaw is exploited in the wild.
👁
Source: ThreatAft