Hackers Exploit Zyxel GS1900 Zero-Day in the Wild After Patch Failure
A critical zero-day vulnerability in Zyxel GS1900 network switches, CVE-2026-107441, is being actively exploited in the wild, with initial patches proving ineffective.
Hackers are actively exploiting a critical zero-day vulnerability, tracked as CVE-2026-107441, in Zyxel GS1900 network switches, a flaw that has persisted even after initial patching attempts failed. Researchers at Binarly discovered that the vulnerability, residing in the dispatcher.cgi, httprestorecfg.cgi, and httpupload.cgi components of the switch's web interface, allows unauthenticated remote command execution with root privileges. This critical flaw, rated 9.8 by CVSS, enables attackers to compromise hundreds of switches globally, stealing sensitive device configurations and credentials.
The attack chain involves a Python script that leverages a Linux backdoor known as JITTERLY, which in turn deploys a rootkit called SIXZUT. This sophisticated malware allows attackers to conceal their presence, steal network data, and maintain persistent access. The exploit targets a buffer overflow vulnerability where the web interface copies request parameters into a fixed memory block. A long value in a specific slot overwrites the counter, allowing an attacker to manipulate memory before the code checks the data length, leading to arbitrary command execution.
Zyxel's initial patch, intended to fix CVE-2026-7273, was found to be ineffective against this new zero-day. Binarly tested ten firmware releases that were supposed to address the issue and found them all still vulnerable. Zyxel acknowledged the new flaw on October 11, 2026, and released a corrected fix on October 22, accompanied by an advisory on November 3. However, Binarly notes that Zyxel's description of the bug's location (global memory versus stack) and its accessibility (normal HTTP from any reachable network) may have led to an underestimation of its severity, with Binarly suggesting a score higher than Zyxel's initial 8.8.
GreyNoise reported that a single threat actor targeted 996 GS1900 switches across 48 countries around August 17, 2026. The stolen data included device settings, hashed root passwords, and network details. Alarmingly, 564 of the compromised switches were still using default factory credentials. The most affected countries were Italy, the United States, and Taiwan.
The exploit utilized a Python script obfuscated with PyArmor, which downloaded a collector script from the attacker's server via TFTP. The stolen data was then exfiltrated to a web-accessible folder. GreyNoise has linked this actor to the Gitea campaign, also known as Red Heron by Acronis, due to shared infrastructure and malware. This campaign is known to employ JITTERLY, a Linux backdoor with extensive command capabilities, and SIXZUT, a rootkit designed for stealth.
While CISA added CVE-2026-7273 to its Known Exploited Vulnerabilities (KEV) list on September 21, 2026, Binarly's findings suggest that either the initial patch was flawed or the attacks targeted a different, albeit related, vulnerability. Regardless, the zero-day discussed in Binarly's advisory remains present in the firmware versions that were supposed to be fixes.
To mitigate this threat, Zyxel urges users to update all GS1900 switches to the October 22, 2026, fix or a newer version. Additionally, network administrators should disable web management interfaces from the internet, restrict access to trusted internal networks, and immediately change all default passwords. CISA also advises monitoring devices for unusual administrative activity, configuration changes, and suspicious web requests. Given that attackers obtained hashed root credentials, any compromised switch should be treated as potentially fully compromised, necessitating a complete password rotation.
Indicators of Compromise (IoCs) for the JITTERLY backdoor and SIXZUT rootkit have been provided, including SHA-256 hashes for various malware samples. These IoCs are crucial for security teams to detect and respond to ongoing infections within their networks.