A new zero-day vulnerability in Zyxel’s GS1900 network switches—designated CVE-2026-107441—has been confirmed after initial attempts to fix a different bug failed to stop widespread exploitation. The patch that Zyxel issued in mid-June (CVE-2026-7273) did not address this separate flaw, and attackers continued to breach devices through it. The fresh advisory and working patch for the new issue were released in late October and published November 3, 2026.
How the Exploit Works
The vulnerability lies within the web interface of the GS1900, specifically in a component called dispatcher.cgi, with similar insecure code also found in httprestorecfg.cgiand httpupload.cgi. Attackers can send a malicious request that writes a long value into slot 139 of a fixed-size memory block. That overflow corrupts the counter used to track how many slots are in use, allowing an attacker to set it negative and write beyond the intended memory region. By doing so, they can overwrite function pointers and execute arbitrary commands as the root user—all without needing to log in.
Timeline & Scope
Zyxel’s initial patch for CVE-2026-7273 shipped June 16, 2026. In September, after real attacks surfaced, researchers tested all ten firmware versions that had been updated in response and found each was still vulnerable. The company acknowledged the existence of a separate, unaddressed flaw on October 11, issued a correct patch on October 22, and released the detailed advisory on November 3.
Attackers were active around August 17, targeting nearly 1,000 GS1900 switches across 48 countries—Italy, the U.S., and Taiwan among the hardest hit. A majority (564) of the compromised devices were using factory-default login credentials. The breach involved stealing device settings, obtaining hashed root passwords, and siphoning off network details.
Malware, Tools & Attribution
The exploit starts with a hidden Python script (shielded via PyArmor), which fetches a collector via TFTP and copies stolen data to web-accessible folders. This activity has been linked to the actor behind the “Gitea campaign,” also known by the name Red Heron, through overlapping infrastructure and malware usage.
The attackers used a Linux backdoor called JITTERLY, with support for over 30 modules, which embeds the SIXZUT rootkit to hide files, processes, and network connections. Researchers detected instances of both in samples gathered from the attacker’s servers.
What Organizations Should Do
All GS1900 switches should be updated immediately to the firmware released on October 22, 2026 or later. It’s critical to remove any management interfaces from public internet access, restrict them to trusted networks, and change all default passwords.
Security teams are urged to hunt for signs of compromise: unexpected admin activity, altered configurations, or unusual web requests. Since root passwords were stolen in hashed form, any device exposed during the breach should be treated as potentially compromised—password rotation is non-negotiable.
Indicators of compromise include signatures for the JITTERLY backdoor and SIXZUT rootkit. Administrators should use these to search through their systems and threat intelligence platforms.
This zero-day now sits in the Known Exploited Vulnerabilities list maintained by CISA, which first added CVE-2026-7273 (the original bug) on September 21. Researchers clarify that either Zyxel’s first patch addressed the wrong issue or that attackers discovered another vulnerability entirely. In either case, all firmware versions claimed to fix the earlier bug were ineffective against this new intelligence.
Analytical Take:This incident underscores how attacks evolve rapidly and highlights the critical role of deep code auditing beyond patch delivery. Security fixes that don’t reflect the actual exploit path leave enterprises exposed. For defenders, the GS1900 case is a strong reminder: never assume a patch means safety—verify, test in real-world scenarios, and monitor live operations closely.
