{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "Zyxel GS1900 switches: zero-day CVE-2026-107441 exploited on ~1,000 switches, the CVE-2026-7273 fix didn't stop it · updates",
  "home_page_url": "https://pwn.watch/i/zyxel-gs1900-switches-zero-day-cve-2026-107441",
  "feed_url": "https://pwn.watch/i/zyxel-gs1900-switches-zero-day-cve-2026-107441/feed.json",
  "description": "Zyxel patched CVE-2026-107441, an out-of-bounds write in the CGI web management program of ten GS1900 switch models that lets an unauthenticated attacker who can reach the web interface run OS commands with a crafted HTTP request. GreyNoise saw a threat actor it tracks as Kapibala compromise 996 GS1900 switches in 48 countries from around August 17, stealing configurations, hashed root credentials and network information. That activity was first blamed on CVE-2026-7273 (patched in June, added to CISA KEV on Sep 21), but Binarly found the recovered exploit still worked on all ten firmware releases that fixed CVE-2026-7273, so switches with only that update stayed exposed. Zyxel shipped fixed 2.90(...3)C0 firmware on Oct 22 and published its advisory on Nov 3. Install the 2.90(...3)C0 build for your model, keep the web management interface on a trusted management VLAN, and check switches whose web UI was reachable from other networks for signs of compromise.",
  "language": "en",
  "_pwn": {
    "slug": "zyxel-gs1900-switches-zero-day-cve-2026-107441",
    "severity": "high",
    "status": "live",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/zyxel-gs1900-switches-zero-day-cve-2026-107441/feed.xml",
    "llms": "https://pwn.watch/i/zyxel-gs1900-switches-zero-day-cve-2026-107441/llms.txt",
    "json": "https://pwn.watch/i/zyxel-gs1900-switches-zero-day-cve-2026-107441.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/zyxel-gs1900-switches-zero-day-cve-2026-107441#2026-11-03-faddcb3b",
      "url": "https://pwn.watch/i/zyxel-gs1900-switches-zero-day-cve-2026-107441#2026-11-03-faddcb3b",
      "title": "Zyxel GS1900 switches: zero-day CVE-2026-107441 exploited on ~1,000 switches, the CVE-2026-7273 fix didn't stop it: Zyxel publishes its security advisory for CVE-2026-107441 covering ten GS1900 models; NVD publishes the CVE (CVSS 8.8).",
      "content_text": "Zyxel GS1900 switches: zero-day CVE-2026-107441 exploited on ~1,000 switches, the CVE-2026-7273 fix didn't stop it: Zyxel publishes its security advisory for CVE-2026-107441 covering ten GS1900 models; NVD publishes the CVE (CVSS 8.8).\n\nSource: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026",
      "date_published": "2026-11-03T00:00:00.000Z",
      "external_url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026",
      "tags": [
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/zyxel-gs1900-switches-zero-day-cve-2026-107441#2026-10-22-38a80e33",
      "url": "https://pwn.watch/i/zyxel-gs1900-switches-zero-day-cve-2026-107441#2026-10-22-38a80e33",
      "title": "Zyxel GS1900 switches: zero-day CVE-2026-107441 exploited on ~1,000 switches, the CVE-2026-7273 fix didn't stop it: Zyxel releases 2.90(...3)C0 firmware that limits parameter sizes and validates the parameter count, assigning the new flaw CVE-2026-107441.",
      "content_text": "Zyxel GS1900 switches: zero-day CVE-2026-107441 exploited on ~1,000 switches, the CVE-2026-7273 fix didn't stop it: Zyxel releases 2.90(...3)C0 firmware that limits parameter sizes and validates the parameter count, assigning the new flaw CVE-2026-107441.\n\nSource: https://www.bleepingcomputer.com/news/security/zyxel-fixes-zero-day-exploited-to-hack-nearly-1-000-network-switches/",
      "date_published": "2026-10-22T00:00:00.000Z",
      "external_url": "https://www.bleepingcomputer.com/news/security/zyxel-fixes-zero-day-exploited-to-hack-nearly-1-000-network-switches/",
      "tags": [
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/zyxel-gs1900-switches-zero-day-cve-2026-107441#2026-09-28-e78d54f4",
      "url": "https://pwn.watch/i/zyxel-gs1900-switches-zero-day-cve-2026-107441#2026-09-28-e78d54f4",
      "title": "Zyxel GS1900 switches: zero-day CVE-2026-107441 exploited on ~1,000 switches, the CVE-2026-7273 fix didn't stop it: Binarly confirms the recovered exploit still works against all ten firmware releases patched for CVE-2026-7273, and reports it to Zyxel on Sep 29.",
      "content_text": "Zyxel GS1900 switches: zero-day CVE-2026-107441 exploited on ~1,000 switches, the CVE-2026-7273 fix didn't stop it: Binarly confirms the recovered exploit still works against all ten firmware releases patched for CVE-2026-7273, and reports it to Zyxel on Sep 29.\n\nSource: https://www.bleepingcomputer.com/news/security/zyxel-fixes-zero-day-exploited-to-hack-nearly-1-000-network-switches/",
      "date_published": "2026-09-28T00:00:00.000Z",
      "external_url": "https://www.bleepingcomputer.com/news/security/zyxel-fixes-zero-day-exploited-to-hack-nearly-1-000-network-switches/",
      "tags": [
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/zyxel-gs1900-switches-zero-day-cve-2026-107441#2026-09-21-96b82e6f",
      "url": "https://pwn.watch/i/zyxel-gs1900-switches-zero-day-cve-2026-107441#2026-09-21-96b82e6f",
      "title": "Zyxel GS1900 switches: zero-day CVE-2026-107441 exploited on ~1,000 switches, the CVE-2026-7273 fix didn't stop it: GreyNoise discloses the campaign and attributes it to CVE-2026-7273; CISA adds CVE-2026-7273 to its Known Exploited Vulnerabilities catalog the same day.",
      "content_text": "Zyxel GS1900 switches: zero-day CVE-2026-107441 exploited on ~1,000 switches, the CVE-2026-7273 fix didn't stop it: GreyNoise discloses the campaign and attributes it to CVE-2026-7273; CISA adds CVE-2026-7273 to its Known Exploited Vulnerabilities catalog the same day.\n\nSource: https://www.bleepingcomputer.com/news/security/zyxel-fixes-zero-day-exploited-to-hack-nearly-1-000-network-switches/",
      "date_published": "2026-09-21T00:00:00.000Z",
      "external_url": "https://www.bleepingcomputer.com/news/security/zyxel-fixes-zero-day-exploited-to-hack-nearly-1-000-network-switches/",
      "tags": [
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/zyxel-gs1900-switches-zero-day-cve-2026-107441#2026-08-17-45d3e7b5",
      "url": "https://pwn.watch/i/zyxel-gs1900-switches-zero-day-cve-2026-107441#2026-08-17-45d3e7b5",
      "title": "Zyxel GS1900 switches: zero-day CVE-2026-107441 exploited on ~1,000 switches, the CVE-2026-7273 fix didn't stop it: Around this date the Kapibala actor exploits 996 GS1900 switches in 48 countries and exfiltrates configurations, hashed root credentials and network information, per GreyNoise.",
      "content_text": "Zyxel GS1900 switches: zero-day CVE-2026-107441 exploited on ~1,000 switches, the CVE-2026-7273 fix didn't stop it: Around this date the Kapibala actor exploits 996 GS1900 switches in 48 countries and exfiltrates configurations, hashed root credentials and network information, per GreyNoise.\n\nSource: https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation",
      "date_published": "2026-08-17T00:00:00.000Z",
      "external_url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation",
      "tags": [
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/zyxel-gs1900-switches-zero-day-cve-2026-107441#2026-06-16-a2e861d2",
      "url": "https://pwn.watch/i/zyxel-gs1900-switches-zero-day-cve-2026-107441#2026-06-16-a2e861d2",
      "title": "Zyxel GS1900 switches: zero-day CVE-2026-107441 exploited on ~1,000 switches, the CVE-2026-7273 fix didn't stop it: Zyxel releases firmware fixing CVE-2026-7273, a pre-authentication buffer overflow in the same GS1900 switches.",
      "content_text": "Zyxel GS1900 switches: zero-day CVE-2026-107441 exploited on ~1,000 switches, the CVE-2026-7273 fix didn't stop it: Zyxel releases firmware fixing CVE-2026-7273, a pre-authentication buffer overflow in the same GS1900 switches.\n\nSource: https://www.bleepingcomputer.com/news/security/zyxel-fixes-zero-day-exploited-to-hack-nearly-1-000-network-switches/",
      "date_published": "2026-06-16T00:00:00.000Z",
      "external_url": "https://www.bleepingcomputer.com/news/security/zyxel-fixes-zero-day-exploited-to-hack-nearly-1-000-network-switches/",
      "tags": [
        "high"
      ]
    }
  ]
}