CVE-2026-107441 (CVSS 8.8): Zyxel GS1900 Zero-Day Bypasses June Patch — Chinese APT Red Heron Compromised 996 Switches in 48 Countries

Last June, Zyxel patched a critical command-injection flaw in its GS1900 managed switches and many IT teams checked the box and moved on. They should not have. On November 3, 2026, Zyxel published an emergency advisory revealing that every device that received that June patch is still vulnerable — because attackers were already exploiting a second, deeper zero-day hidden inside the same code. The new vulnerability, CVE-2026-107441, lets an unauthenticated attacker on any network segment that can reach the switch’s web management interface run arbitrary OS commands as root. By the time Zyxel’s Patch 3 firmware landed, threat intelligence firm GreyNoise had already watched a single Chinese-linked actor silently compromise 996 Zyxel GS1900 switches across 48 countries in under 48 hours.

For Indian enterprises, government networks, and managed service providers running GS1900 hardware in campus distribution layers, server-room access stacks, or SD-WAN aggregation points, this is not a theoretical risk. It is an active campaign that collected hashed root credentials, full network topologies, and device configurations from almost a thousand organisations before anyone knew the patch had failed. Even worse: 564 of those 996 devices were still running factory-default usernames and passwords — a reminder that credential hygiene is still losing the battle against opportunistic nation-state reconnaissance.

This post breaks down what CVE-2026-107441 actually is, why the June fix did not stop it, who is behind the campaign, which firmware builds are safe, and exactly what your team needs to do before the weekend.

Why the June Patch Missed the Real Vulnerability

When Zyxel patched CVE-2026-7273 in June 2026, it targeted a specific command-injection path in the GS1900 web management interface. What Binarly’s researchers discovered — and Red Heron had apparently already found before them — is that the root cause ran deeper. The underlying issue is an out-of-bounds write in the HTTP request parser itself, triggered by crafted HTTP requests with malformed field lengths. Zyxel’s June fix added an input-validation guard further up the call chain, but it did not eliminate the memory-corruption primitive lower down.

Binarly’s analysis shows that the vulnerable parsing code is present in all ten firmware releases that shipped the June patch — in other words, every administrator who dutifully applied CVE-2026-7273’s fix was still running exploitable code. CVE-2026-107441 was quietly assigned as a separate flaw because the missing size check is architecturally distinct from the injection vector Zyxel believed it had closed. This is a classic incomplete patch scenario: fix the symptom without addressing the root cause, and a motivated attacker with the original firmware will find the second path faster than the vendor’s QA cycle does.

Binarly argues the vendor’s CVSS score of 8.8 understates the real risk. The exploit works over plain HTTP, requires no prior authentication, no user interaction, and no special network position beyond being able to reach TCP port 80 or 443 on the management interface — a bar many deployments meet because management VLANs are routinely reachable from network operations tools, monitoring servers, or misconfigured jump hosts.

Technical Breakdown: CVE-2026-107441 Exploitability

The attack surface is the GS1900’s built-in Boa HTTP web server, which handles the device’s graphical management console. The out-of-bounds write is triggered in the request parser when processing a specially crafted HTTP request with oversized header fields. By overwriting adjacent memory, an attacker can redirect control flow to attacker-controlled shellcode or use a return-oriented programming (ROP) chain — Binarly’s proof-of-concept delivers a reverse shell running as the web daemon process, which on GS1900 firmware runs with root privileges.

Because the attack requires only network access to the management port and zero credentials, it is trivially weaponisable. GreyNoise’s sensors, which observe attacker reconnaissance and exploitation at scale, recorded the campaign scanning for GS1900 devices and exploiting the flaw autonomously — all within a 48-hour window in mid-August 2026, months before Zyxel published its advisory. The attacker systematically extracted:

• Running configuration dumps (VLANs, ACLs, port assignments)
• Hashed root passwords (/etc/shadow)
• ARP and MAC address tables (network topology maps)
• SNMP community strings where configured

This intelligence package is precisely what a sophisticated threat actor needs to plan lateral movement deeper into a corporate or campus network — particularly in environments where the switch management VLAN is not strictly isolated from server or user segments.

Red Heron: The Chinese APT Behind the Campaign

The actor GreyNoise attributes this campaign to is Red Heron, a Chinese-speaking threat group tracked by Acronis and cross-correlated by GreyNoise through shared command-and-control infrastructure and malware tooling with an earlier intrusion campaign called the Gitea campaign. Some vendor reports use the alias Kapibala for a subcluster of the same infrastructure. The group’s known focus is network infrastructure — routers, switches, VPN concentrators, and similar devices that provide long-dwell-time footholds without triggering endpoint detection and response (EDR) tools, because managed switches typically run no EDR agent at all.

Red Heron’s methodology here is consistent with Chinese intelligence-collection operations: broad initial compromise for credential and topology harvesting, followed by selective deep exploitation of high-value targets identified from the stolen configuration data. The group is not known primarily for ransomware; its interest is persistent access and intelligence gathering, which makes the stolen hashed passwords and network maps especially concerning — they are almost certainly being cracked and cross-referenced against other breach databases.

India is in the blast radius. GreyNoise’s dataset of 996 compromised devices spans 48 countries, and given the density of Zyxel GS1900 deployments in South and Southeast Asian university campuses, manufacturing plants, and SMB-segment office buildings, Indian organisations are statistically represented. If your organisation operates GS1900 switches and has not yet moved to Patch 3 firmware, treat this as a probable compromise until proven otherwise.

Affected Models and Safe Firmware Versions

Zyxel’s advisory covers ten GS1900 models. The table below lists the vulnerable and patched firmware builds. If your switch is not running the Patch 3 build, it remains exploitable.

Model	Last Vulnerable Firmware	Patch 3 (Safe) Build
GS1900-8	2.80(AAHH.2)C0	2.90(AAHH.3)C0
GS1900-8HP	2.80(AAHI.2)C0	2.90(AAHI.3)C0
GS1900-10HP	2.80(AAZI.2)C0	2.90(AAZI.3)C0
GS1900-16	2.80(AAHJ.2)C0	2.90(AAHJ.3)C0
GS1900-24	2.80(AAHL.2)C0	2.90(AAHL.3)C0
GS1900-24E	2.80(AAHM.2)C0	2.90(AAHM.3)C0
GS1900-24HP	2.80(AAHN.2)C0	2.90(AAHN.3)C0
GS1900-48	2.80(AAHO.2)C0	2.90(AAHO.3)C0
GS1900-48HP	2.80(AAHP.2)C0	2.90(AAHP.3)C0
GS1900-48HPV2	2.80(ABMH.2)C0	2.90(ABMH.3)C0

Downloads are available from the Zyxel firmware download portal. Cross-reference your installed version against the table above before anything else.

What You Should Do Right Now — Sanjay’s Expert Checklist

In over three decades of network security work, I have watched the same incident pattern repeat: a patch arrives, teams apply it, and the false sense of remediated risk sets in. CVE-2026-107441 is a textbook example of why patch verification must include root-cause analysis, not just the advisory title. Here is the priority action list for NOC and SOC teams today:

1. Inventory every GS1900 immediately. Pull your SNMP/LLDP inventory or run a quick subnet scan for Zyxel sysObjectID strings. Any GS1900 not running Patch 3 firmware is an open door. This should take less than 30 minutes in a well-documented environment — and if it takes longer, that is itself a finding.
2. Isolate management interfaces now. Place all switch management ports in a dedicated, non-routed management VLAN reachable only from your out-of-band management network or a hardened jump server. If your management VLAN is reachable from user, server, or IoT VLANs, an attacker who gets a foothold anywhere in those zones has a path to the switch console. This is a zero-trust segmentation principle — apply it to management planes first.
3. Rotate every credential on every GS1900. Treat all saved passwords as compromised. The GreyNoise data confirms credential exfiltration. Change root/admin passwords on the switches, rotate SNMP community strings, and rotate any other credential stored on a device that shared a network segment with these switches.
4. Hunt for indicators of compromise. Review syslog and RADIUS logs for unexpected authentication attempts, configuration-read events, or HTTP requests against the web management daemon. Check for unexpected ARP or MAC table exports. If your SIEM ingests switch syslogs, write a rule for HTTP 200 responses from the management interface to source IPs outside your authorised management subnet.
5. Apply Patch 3 firmware in a maintenance window — this week. Do not defer this to next month’s patching cycle. Patch 3 addresses the root-cause memory-corruption primitive. The upgrade path is a standard Zyxel firmware flash; most models support in-place upgrade from the web GUI without a full reboot-to-defaults.
6. Enforce non-default credentials as a standing policy. 564 of 996 compromised devices used factory defaults. If you manage a large campus or multi-site network, deploy a configuration compliance check that alerts on default credential strings as part of your SD-WAN and campus network governance process.

For further context on how Chinese APT groups exploit network-layer footholds to bypass perimeter controls, see Binarly’s full research at binarly.io, the CISA KEV catalogue entry for CVE-2026-7273, and the original SecurityWeek report at securityweek.com.

Frequently Asked Questions

Does this affect Zyxel’s enterprise XGS or XS series switches, or only the GS1900 range?

Zyxel’s advisory and Binarly’s research are specific to the GS1900 series. The XGS, XS, and other product lines run different firmware and were not mentioned in the advisory. However, if your environment includes other Zyxel models, you should review Zyxel’s security advisory archive for any concurrent advisories, as the June CVE-2026-7273 patch affected a wider set of Zyxel products.

We applied the June CVE-2026-7273 patch and have not seen any alerts. Are we safe?

No. The Red Heron campaign ran in mid-August 2026 and was silent by design — the attacker read configurations and credentials without leaving obvious operational traces. A clean SIEM for the last three months does not rule out credential exfiltration. Assume compromise, rotate credentials, and apply Patch 3 regardless of whether you observed any anomalies.

How do I confirm which firmware version my GS1900 is running?

Log into the web GUI, go to Maintenance > Firmware Upgrade; the installed version is displayed at the top of the page. Alternatively, query via SNMP: snmpget -v2c -c <community> <switch-ip> SNMPv2-MIB::sysDescr.0 — the response includes the firmware string. Compare the installed version to the Patch 3 column in the table above. If the minor version does not read 2.90, you are vulnerable.

Should we disable the web management interface entirely until we can patch?

If your operational workflow allows it, yes — disabling or ACL-restricting the HTTP/HTTPS management port is an effective temporary mitigant that eliminates the attack surface for CVE-2026-107441 while you schedule the firmware upgrade. Use the CLI via serial console or SSH to restrict management access to a specific source IP range (ip http access-class) on models that support it. For switches already in a compromised state, treat this as a containment step, not a remediation.

---

The Zyxel GS1900 story is a sharp reminder that incomplete patches create a false sense of security that adversaries actively exploit. Red Heron did not need a zero-day exploit kit — it needed only the knowledge that an earlier patch had not addressed the root cause, and an internet-connected scan. That is exactly the kind of gap that a structured security review catches before an attacker does.

If you are running Zyxel GS1900 switches in your campus, data-centre edge, or branch network and need a rapid assessment of your exposure — or if you want to build the management-plane segmentation controls that would have prevented this campaign from succeeding — reach out to Sanjay Seth for a network security assessment. With three decades of hands-on experience in network architecture across Indian enterprise and government environments, we can help you identify what your patch cycle missed.