A flaw in Zyxel GS1900 switches was already being used by hackers, and the patch meant to fix it did not work. Researchers at Binarly found that a public exploit hit a different bug than the one Zyxel had patched. Zyxel has now confirmed it as a new flaw, tracked as CVE-2026-107441.

Zyxel published its fix for CVE-2026-7273 on June 16, 2026. After GreyNoise reported real attacks in September, Binarly tested all ten fixed firmware releases on September 28 and found every one still open. Zyxel confirmed the new bug on October 11, shipped a fix on October 22, and published its advisory on November 3.

The flaw sits in the dispatcher.cgi web program. It carries a 9.8 critical score, and an attacker can run commands as root without logging in. The same weak code also exists in httprestorecfg.cgi and httpupload.cgi.

Zyxel GS1900 Zero-Day Exploited

The switch web page stores request parameters in a fixed memory block of 140 slots. Each slot holds 1,024 bytes. The code copies the data first and checks the count afterward. A long value in slot 139 spills over and overwrites the counter itself.

An attacker can set the counter to a negative number and write to memory before the block. This lets them overwrite function pointers and run their own commands. Zyxel’s patch added a count check, but the bad copy still happens before that check runs.

Binarly also says Zyxel described the bug wrongly. The flaw lives in global memory, not on the stack. It also works over normal HTTP from any network that can reach the switch, so Binarly rates it higher than the 8.8 score Zyxel gave.

GreyNoise says one actor hit 996 GS1900 switches in 48 countries around August 17. The actor stole device settings, hashed root passwords, and network details. A total of 564 of those switches still used factory default logins. Italy, the United States, and Taiwan had the most victims.

The exploit was a Python script hidden with PyArmor. It pulled a collector script from the attacker’s server using TFTP, then copied the stolen data to a web-readable folder. GreyNoise ties the actor to the Gitea campaign that Acronis called Red Heron, based on shared servers and malware.

That campaign used JITTERLY, a Linux backdoor with more than 30 commands. It hides a rootkit called SIXZUT inside itself, which can conceal files, processes, and network links. Binarly found its samples while checking this server for Binarly Transparency Platform detections.

CISA added CVE-2026-7273 to its Known Exploited Vulnerabilities list on September 21. Our earlier report on the CISA warning for Zyxel GS1900 switches covers that step. Binarly now says either Zyxel’s first patch was wrong, or the attacks hit a different bug than CISA named. Either way, the flaw in Binarly’s advisory is present in the ten releases sold as fixes.

The same actor also broke into WordPress sites, as our story on hackers exploiting WordPress flaws to steal government records shows. GreyNoise counted more than 18,000 stolen records in one case.

Update every GS1900 switch to the October 22 fix or newer from Zyxel. Take web management pages off the internet and limit them to trusted admin networks. Change all default passwords right away.

CISA also tells teams to check devices for odd admin activity, changed settings, and strange web requests. Because attackers took hashed root credentials, treat any exposed switch as possibly stolen and rotate its passwords.

Indicators of Compromise

Malware	Type	SHA-256
JITTERLY	Backdoor	0f6e757e82c4d91df5bd249f775b9970b59dee42cc0dfe40f879d77fc16821c6
JITTERLY	Backdoor	663a8088faca8e126a11648f5671fcf4eaf96435e10daf63a1d1b17d8385154c
JITTERLY	Backdoor	82d072ab03d90c0131b06a576eadf2c986a51f0de986d50db4e49be01bf125cb
SIXZUT	Rootkit	295133156b6a7d95b9c92f832f49e35235f1fbd3906e75c9202ef4cd65d1018c
SIXZUT	Rootkit	64677002011bc2e4bc642a4154a20fdb95620ebd0144b98fc60f917901ec8b92
SIXZUT	Rootkit	728810b07e911b235f6450e784391e39f68819a0a5d209662162916ffea25146

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hackers Exploit Zyxel GS1900 Zero-Day in the Wild to Hijack Network Switches appeared first on Cyber Security News.