Zyxel GS1900: the June patch did not stop zero-day CVE-2026-107441
Do you have a Zyxel GS1900 switch in the wiring closet? Since August 2026, a group tracked as Kapibala (linked to the Red Heron campaign) has compromised about 996 of these devices across 48 countries. An older flaw patched in June was blamed at first. Binarly then proved the exploit still worked on every “Patch 2” firmware. The real flaw, CVE-2026-107441, got its Zyxel advisory on November 3, 2026.
Here’s the timeline, the model table to patch, and the checklist to run today — even if you think you’re already up to date.
Zyxel GS1900: timeline of a misnamed zero-day
From the wrong CVE to the real one
June 16, 2026
Fix for CVE-2026-7273
Zyxel ships updates for a pre-auth out-of-bounds write on GS1900 switches (often called “Patch 2”).
Around Aug. 17
Kapibala / Red Heron campaign
GreyNoise observes exploitation of GS1900 switches. About 996 devices across 48 countries are compromised; configurations and hashed root credentials are exfiltrated.
Sept. 21
Wrong attribution
GreyNoise publishes linking the campaign to CVE-2026-7273. CISA adds that CVE to its Known Exploited Vulnerabilities catalog the same day.
Sept. 28–29
Binarly contradicts the diagnosis
Analyzing a recovered exploit, Binarly shows it still works on every Patch 2 firmware, and reports it to Zyxel.
Oct. 22
Patch 3 (firmware .3)
Zyxel ships 2.90(…).3 firmwares that limit HTTP parameter sizes and validate the parameter count before copying into memory.
Nov. 3
Official advisory CVE-2026-107441
Zyxel publishes the advisory for the out-of-bounds write in dispatcher.cgi / the web UI: unauthenticated LAN attacker → OS command execution.
In short: the June fix closed one door. Attackers used another, in the same CGI program. If your GS1900 stayed on 2.90(…).2, it was not protected against this campaign.
Affected models and firmwares to install
Per Zyxel’s November 3, 2026 advisory, ten GS1900 series models are affected. Versions 2.90(…).2 and earlier → move to 2.90(…).3:
| Model | Affected version | Fix (Patch 3) |
|---|---|---|
| GS1900-8 | 2.90(AAHH.2)C0 and earlier | 2.90(AAHH.3)C0 |
| GS1900-8HP | 2.90(AAHI.2)C0 and earlier | 2.90(AAHI.3)C0 |
| GS1900-10HP | 2.90(AAZI.2)C0 and earlier | 2.90(AAZI.3)C0 |
| GS1900-16 | 2.90(AAHJ.2)C0 and earlier | 2.90(AAHJ.3)C0 |
| GS1900-24 | 2.90(AAHL.2)C0 and earlier | 2.90(AAHL.3)C0 |
| GS1900-24E | 2.90(AAHK.2)C0 and earlier | 2.90(AAHK.3)C0 |
| GS1900-24EP | 2.90(ABTO.2)C0 and earlier | 2.90(ABTO.3)C0 |
| GS1900-24HPv2 | 2.90(ABTP.2)C0 and earlier | 2.90(ABTP.3)C0 |
| GS1900-48 | 2.90(AAHN.2)C0 and earlier | 2.90(AAHN.3)C0 |
| GS1900-48HPv2 | 2.90(ABTQ.2)C0 and earlier | 2.90(ABTQ.3)C0 |
On the switch UI, note the exact firmware number before and after the update. Don’t trust a vague “up to date” flag in a third-party tool.
Why 564 devices didn’t even need the exploit
GreyNoise also found that 564 of the 996 compromised switches still had factory-default credentials. In other words: even without the zero-day, a reachable web UI with the default password was often enough. Two lessons for an SMB:
996
GS1900 switches compromised (GreyNoise)
48
Countries affected
564
Still on factory defaults
Oct. 22
Patch 3 firmware date
Decision checklist for your wiring closet
Do this in order
- ☐ Inventory: do you have a GS1900-8, -8HP, -10HP, -16, -24, -24E, -24EP, -24HPv2, -48 or -48HPv2?
- ☐ Firmware: install Patch 3 (2.90(…).3) for your model from Zyxel’s site or portal.
- ☐ Exposure: the switch web UI must not be reachable from the internet. Manage it from the LAN (or a VPN) only.
- ☐ Credentials: immediately change any password still at the factory value; set a unique, long password.
- ☐ Assume theft: if the UI was reachable during the campaign window (from mid-August), assume configuration and credentials may have been stolen — rotate related secrets and watch for VLAN / port-mirror changes.
- ☐ Proof: keep a screenshot or export of the System Information page showing the new firmware.
A poorly managed switch often opens the path to the rest of the network, as we’ve seen with other exposed gear in our articles on SMB cybersecurity and server management.
How NeoTech can help
We inventory your switches, apply Patch 3, pull the web UI off the internet and rotate credentials. Our automated 24/7 monitoring with on-call technician response flags network configuration changes and new admin accounts. For a full picture, see our cybersecurity services and our cloud services and consulting.
Book your free cyber check
In 30 minutes, we check together whether you have a GS1900, which firmware it shows, and whether its web UI is visible from outside.
Call us at 438-476-2322 or email info@neotechcloudsolutions.com.
Our office: 2572 boul. Daniel-Johnson, office 237, Laval.
Sources
- Zyxel — Security advisory GS1900 (CVE-2026-107441), November 3, 2026
- BleepingComputer — Zyxel fixes zero-day exploited to hack nearly 1,000 network switches, November 4, 2026
- The Hacker News — Zyxel GS1900 patch fails to block zero-day, November 2026
- GreyNoise — Open Season on Kapibala (996 GS1900 switches)
Photo: Pixabay, Pexels (Pexels licence).