{"id":10311,"date":"2026-11-05T09:44:42","date_gmt":"2026-11-05T09:44:42","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=10311"},"modified":"2026-11-05T09:44:42","modified_gmt":"2026-11-05T09:44:42","slug":"zyxel-patches-a-zero-day-hiding-behind-an-old-fix","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=10311","title":{"rendered":"Zyxel patches a zero-day hiding behind an old fix"},"content":{"rendered":"<div>\n<div class=\"grid grid--cols-10@md grid--cols-8@lg article-column \">\n<div class=\"col-12 col-10@md col-6@lg col-start-3@lg\">\n<div class=\"article-column__content\">\n<div class=\"container\"><\/div>\n<p class=\"wp-block-paragraph\">Zyxel has patched a zero-day vulnerability that attackers exploited to compromise 996 GS1900 network switches across 48 countries, exposing device configurations, network information and hashed root credentials. The attack began around August 17, according to cybersecurity firm GreyNoise, but researchers initially blamed a different vulnerability that Zyxel had already addressed.<\/p>\n<p class=\"wp-block-paragraph\">The newly identified flaw, tracked as <a href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-107441\" target=\"_blank\" rel=\"noopener\">CVE-2026-107441<\/a>, is a CVSS 8.8 out-of-bounds write vulnerability in the switches\u2019 web management interface. It allows unauthenticated attackers with network access to execute operating system commands through specially crafted HTTP requests.<\/p>\n<p class=\"wp-block-paragraph\">The flaw affects ten GS1900 models, including GS1900-8, GS1900-24, and GS1900-48. Zyxel listed firmware versions ending in .2C0 and earlier as vulnerable, with model-specific fixes in versions ending in .3C0.<\/p>\n<p class=\"wp-block-paragraph\">Zyxel released a fix for <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/cve-2026-7273\" target=\"_blank\" rel=\"noopener\">CVE-2026-7273<\/a> in June, addressing a separate buffer overflow in the same switch series. GreyNoise initially <a href=\"https:\/\/www.greynoise.io\/blog\/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation\" target=\"_blank\" rel=\"noopener\">attributed<\/a> the attacks to that vulnerability, prompting CISA to <a href=\"https:\/\/www.cisa.gov\/news-events\/alerts\/2026\/09\/21\/cisa-adds-one-known-exploited-vulnerability-catalog\" target=\"_blank\" rel=\"noopener\">add it <\/a>to its Known Exploited Vulnerabilities catalog in September.\u00a0<\/p>\n<p class=\"wp-block-paragraph\">However, security researchers at Binary <a href=\"https:\/\/www.binarly.io\/blog\/zyxel-gs1900-rce-cve-2026-107441\" target=\"_blank\" rel=\"noopener\">discovered<\/a> an exploit targeting a previously unknown flaw that remained effective even on switches running the June updates. The researchers reported the vulnerability to Zyxel on September 29.<\/p>\n<p class=\"wp-block-paragraph\">The attackers used a script to collect device configurations, hashed root credentials, and network information. Such data can give intruders a useful map of an organization\u2019s network and potentially help them move deeper into its infrastructure. Zyxel released firmware updates on October 22 and published its <a href=\"https:\/\/www.zyxel.com\/global\/en\/support\/security-advisories\/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026\" target=\"_blank\" rel=\"noopener\">advisory<\/a> on November 3. Administrators should update affected GS1900 switches, including those already running June security fixes.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>Zyxel has patched a zero-day vulnerability that attackers exploited to compromise 996 GS1900 network switches across 48 countries, exposing device configurations, network information and hashed root credentials. The attack began around August 17, according to cybersecurity firm GreyNoise, but researchers initially blamed a different vulnerability that Zyxel had already addressed. The newly identified flaw, tracked [&hellip;]<\/p>\n","protected":false},"author":0,"featured_media":10312,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-10311","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10311"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=10311"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10311\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/10312"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=10311"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=10311"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=10311"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}