Zyxel has rushed out new firmware for ten models in its GS1900 line of network switches after researchers found that a security hole patched back in June never actually closed. The real bug, now tracked as CVE-2026-107441, is an out-of-bounds write in the switch's web-management software that lets an unauthenticated attacker on the local network run commands on the device, and it carries a severity score of 8.8 out of 10.
The flaw came to light almost by accident. Researchers at the firm Binarly were digging through infrastructure tied to a Chinese-speaking hacking crew that threat-intelligence firm GreyNoise tracks as Kapibala, or Red Heron, when they found an exposed archive containing a working exploit script aimed squarely at GS1900 switches. Binarly reported the bug to Zyxel on Sept. 29; the company confirmed it on Oct. 11 and has now shipped the fix in firmware version V2.90 Patch 3.
By the time the patch landed, the damage was largely done. GreyNoise says the exploit — which works even on switches that installed Zyxel's original June patch for a related bug, CVE-2026-7273 — had already been used to compromise nearly 1,000 devices worldwide since August, stealing configuration files and login credentials over a campaign that ran largely unnoticed for roughly two months before Binarly's research led back to it. Attackers used the access to install two pieces of malware: a backdoor called JITTERLY and a "ring 3" rootkit called SIXZUT that hides its presence from the operating system.
Hundreds of the victims made the intrusion easy. GreyNoise found that 564 of the compromised switches were still running Zyxel's factory-default administrator credentials — meaning attackers in many cases didn't need the zero-day at all to get in, only a password nobody had bothered to change.
The vulnerability has not yet been added to the U.S. Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog, and Zyxel's own advisory does not state whether the flaw has been actively exploited, even as outside researchers describe live attacks. BleepingComputer and SecurityWeek both recommend that GS1900 owners install the new firmware immediately and treat any switch that hasn't been updated since before Patch 3 as potentially already compromised, since reflashing alone won't remove malware already installed on a device.
