Zyxel patched CVE-2026-107441, a zero-day in its GS1900 switches that attackers used to compromise nearly 1,000 devices, BleepingComputer reports.
The details
- An out-of-bounds write in the web management interface lets an unauthenticated attacker run OS commands with crafted HTTP requests
- Ten GS1900 models are affected. Fixes shipped Oct 22, and the advisory came Nov 3
- GreyNoise saw a suspected Chinese-speaking actor, Kapibala, compromise 996 switches in 48 countries starting around Aug 17, stealing configs, hashed root credentials and network info
- It was first blamed on CVE-2026-7273, an older bug patched in June, so people who’d patched that weren’t actually safe
My take
Patch the firmware, never expose switch management to the internet, and if yours was exposed, change credentials and review the config.
God Bless, and Use the Source!
