CISA orders Zyxel switch patching as Chinese-linked hackers breach nearly 1,000 devices

TLDR

• Binarly found the GS1900 exploit works on firmware patched for CVE-2026-7273; Zyxel tracks the flaw as CVE-2026-107441.⁴⁶
• Zyxel's 3 November advisory lists ten GS1900 models, fixed in 2.90(xxxx.3)C0, and no workarounds.⁵
• The advisory does not mention exploitation; BleepingComputer, citing Binarly, ties the flaw to the nearly 1,000 compromised switches.⁴⁵

CISA added a critical Zyxel GS1900 series switch flaw, CVE-2026-7273 (CVSS 8.8), to its Known Exploited Vulnerabilities catalogue on 21 September, ordering federal agencies to patch by 24 September under Binding Operational Directive 26-04². The stack-based buffer overflow lets an unauthenticated attacker on the local network run OS commands via a crafted HTTP request; Zyxel shipped fixes for ten affected switch models back in June¹².

Threat intelligence firm GreyNoise says a suspected Chinese-speaking actor has exploited the flaw since mid-August, compromising 996 Zyxel switches across 48 countries and stealing hashed root credentials and configuration data, with more than 18,000 records taken from one Western government organisation's backend database¹. GreyNoise believes the activity may overlap with a group it calls Red Heron, separately linked to exploitation of a Gitea vulnerability¹³.

Why it matters: switches on the 2.90(xxxx.2)C0 firmware that fixed CVE-2026-7273 remain affected by CVE-2026-107441 until updated to the .3 release, so administrators who applied only that earlier fix should check their firmware versions.⁴⁵⁶

Update, 5 November 2026: Zyxel has disclosed a second GS1900 flaw, CVE-2026-107441, that BleepingComputer reports was exploited in the same campaign, and which the June fix for CVE-2026-7273 did not stop.⁴ Zyxel's advisory, whose revision history gives 3 November as the initial release, describes an out-of-bounds write in the CGI program of the switch firmware that could let an unauthenticated, LAN-based attacker run OS commands through a crafted HTTP request.⁵ It lists ten GS1900 models, says firmware 2.90(xxxx.2)C0 and earlier is affected, and names 2.90(xxxx.3)C0 as the patched release for each.⁵ The advisory lists no workarounds, gives no severity score and does not say whether the flaw is exploited.⁵ SecurityOnline, citing the CVE record, lists a CVSS score of 8.8.⁶

BleepingComputer says Binarly found an exposed archive on Red Heron infrastructure, tied to the JITTERLY backdoor and SIXZUT rootkit, that held an obfuscated Python exploit for GS1900 switches.⁴ It says the exploit checked for firmware already patched for CVE-2026-7273 and that Binarly confirmed it worked against all ten patched releases.⁴ According to BleepingComputer, the June fix added buffer-overflow checks, but the exploit got around them by corrupting a parameter counter before it was validated.⁴ SecurityOnline, quoting Binarly, says the vulnerable code copies request parameters into a fixed buffer without checking their size or number, and that the earlier patch added its checks too late.⁶ It also reports that Zyxel told Binarly the CVE-2026-7273 fix covered a missing counter check, and that Zyxel treats the missing parameter size check as a separate flaw.⁶ BleepingComputer says it is unclear whether the exploit was built to bypass the earlier patches or hit a related bug those patches missed.⁴

BleepingComputer gives this timeline: Binarly confirmed the exploit still worked on patched firmware on 28 September, reported it to Zyxel on 29 September, and Zyxel confirmed the flaw and assigned the CVE on 11 October.⁴ It says fixed firmware followed on 22 October and the advisory on 3 November.⁴ SecurityOnline also gives 22 October for the firmware, while Zyxel's community release post for the patch 3 firmware is dated 23 October, so the exact release day differs between sources.⁶⁷ That post lists CVE-2026-107441 as the fix for a pre-authentication out-of-bounds write.⁷ BleepingComputer repeats GreyNoise's earlier figures of 996 compromised devices in 48 countries, exploitation from about 17 August, and stolen configuration files and credentials, and attributes the activity to a suspected Chinese-speaking actor GreyNoise tracks as Kapibala, linked to the Red Heron campaign.⁴