Skip to content
~/pwn.watch_

Get notified

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Only used for pwn.watch incident emails. Protected by Cloudflare Turnstile.

Become a sponsor

One slot: pwn.watch, gifs.so, flavors.design, kitze.io, every kitze repo, and an X shout-out.

YearlyBest value · save 44%$999/year$83.25/mo, billed yearly. Save $789 vs monthly (5+ months free).Monthly$149/monthBilled monthly. Cancel anytime.

Secure checkout on Polar. Right after paying you set up your ad on kitze.io.

← Live incidents
LivePatchedPatch now

Zyxel GS1900 switches: zero-day CVE-2026-107441 exploited on ~1,000 switches, the CVE-2026-7273 fix didn't stop it

Zyxel GS1900 series switches (10 models) firmware 2.90(...2)C0 and earlier

Brought to you byTinkerer Club

The private club for people who own their servers, run their own AI, and pay $0/month for software.

Zyxel patched CVE-2026-107441, an out-of-bounds write in the CGI web management program of ten GS1900 switch models that lets an unauthenticated attacker who can reach the web interface run OS commands with a crafted HTTP request. GreyNoise saw a threat actor it tracks as Kapibala compromise 996 GS1900 switches in 48 countries from around August 17, stealing configurations, hashed root credentials and network information. That activity was first blamed on CVE-2026-7273 (patched in June, added to CISA KEV on Sep 21), but Binarly found the recovered exploit still worked on all ten firmware releases that fixed CVE-2026-7273, so switches with only that update stayed exposed. Zyxel shipped fixed 2.90(...3)C0 firmware on Oct 22 and published its advisory on Nov 3. Install the 2.90(...3)C0 build for your model, keep the web management interface on a trusted management VLAN, and check switches whose web UI was reachable from other networks for signs of compromise.

Why this severity: Unauthenticated OS command execution (NVD CVSS 8.8, adjacent network); exploited in the wild against 996 switches before the fix

Started
Aug 17, 2026
CVEs
CVE-2026-107441CVE-2026-7273

Follow this incident

Discuss on X ↗

Affected

  • GS1900-8 2.90(AAHH.2)C0 and earlier
  • GS1900-8HP 2.90(AAHI.2)C0 and earlier
  • GS1900-10HP 2.90(AAZI.2)C0 and earlier
  • GS1900-16 2.90(AAHJ.2)C0 and earlier
  • GS1900-24 2.90(AAHL.2)C0 and earlier
  • GS1900-24E 2.90(AAHK.2)C0 and earlier
  • GS1900-24EP 2.90(ABTO.2)C0 and earlier
  • GS1900-24HPv2 2.90(ABTP.2)C0 and earlier
  • GS1900-48 2.90(AAHN.2)C0 and earlier
  • GS1900-48HPv2 2.90(ABTQ.2)C0 and earlier

Fixed in

  • GS1900-8 2.90(AAHH.3)C0
  • GS1900-8HP 2.90(AAHI.3)C0
  • GS1900-10HP 2.90(AAZI.3)C0
  • GS1900-16 2.90(AAHJ.3)C0
  • GS1900-24 2.90(AAHL.3)C0
  • GS1900-24E 2.90(AAHK.3)C0
  • GS1900-24EP 2.90(ABTO.3)C0
  • GS1900-24HPv2 2.90(ABTP.3)C0
  • GS1900-48 2.90(AAHN.3)C0
  • GS1900-48HPv2 2.90(ABTQ.3)C0

Timeline6

  1. Zyxel publishes its security advisory for CVE-2026-107441 covering ten GS1900 models; NVD publishes the CVE (CVSS 8.8).

  2. Zyxel releases 2.90(...3)C0 firmware that limits parameter sizes and validates the parameter count, assigning the new flaw CVE-2026-107441.

  3. Binarly confirms the recovered exploit still works against all ten firmware releases patched for CVE-2026-7273, and reports it to Zyxel on Sep 29.

  4. GreyNoise discloses the campaign and attributes it to CVE-2026-7273; CISA adds CVE-2026-7273 to its Known Exploited Vulnerabilities catalog the same day.

  5. Around this date the Kapibala actor exploits 996 GS1900 switches in 48 countries and exfiltrates configurations, hashed root credentials and network information, per GreyNoise.

  6. Zyxel releases firmware fixing CVE-2026-7273, a pre-authentication buffer overflow in the same GS1900 switches.

Advisories2

News & write-ups2

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Sponsored

Buy sponsor slot · $149/mo