In September, the story about nearly 1,000 hacked Zyxel switches was simple: an old bug, a June patch, people who didn't apply it. Binarly now says that story was wrong. The attackers were using a bug nobody knew about, and the June patch wouldn't have saved you.
The Backstory
On September 21, GreyNoise reported that an attacker had pulled data from about 1,000 Zyxel GS1900 managed switches around mid-August. The exploitation was tied to CVE-2026-7273, which Zyxel had fixed in June with firmware 2.90 Patch 2. CISA added CVE-2026-7273 to its KEV catalog the same day. Reasonable conclusion at the time: patch to Patch 2 and you're fine.
What Changed
Binarly dug into the exploit and found it wasn't hitting CVE-2026-7273 at all. In SecurityWeek's summary, the flaw "was exploited in the wild as a zero-day to hack almost 1,000 devices," and Binarly says the attackers' "exploit targeted a previously unknown vulnerability."
That new bug is CVE-2026-107441, an out-of-bounds write in the switch's web request handler. Zyxel says an unauthenticated attacker can use crafted HTTP requests to get OS command execution. Zyxel rates it 8.8; Binarly rates it 9.8.
The technical part is almost painful. Per Binarly's analysis as reported by The Hacker News, the handler stores request parameters in a fixed array of 140 entries with no size check. An oversized parameter overwrites the counter. Patch 2 added a check on that counter, but "the check runs only after the oversized parameter has been copied." Too late to matter.
Timeline:
- September 29: Binarly reports it to Zyxel.
- October 23: Zyxel posts 2.90 Patch 3 firmware.
- November 3: Zyxel publishes its advisory, covering 10 GS1900 models.
To be precise about who said what: Binarly says this was exploited as a zero-day. Zyxel confirmed the vulnerability and fixed it, but from what I've read, its advisory doesn't say whether it was exploited. GreyNoise also found 564 of the compromised switches were still on factory-default credentials, which tells you something about how these boxes get deployed.
Why I Keep Writing This Post
This is the third time in a few weeks I've written some version of "the management interface of a network device was the way in." Volt Typhoon, Cisco SD-WAN, now a fleet of small-business switches.
Every vendor ships bugs, Zscaler included (I work there, so weigh my bias). The architectural point stands anyway: a management interface that the internet can reach is a door, and doors get tried. A switch admin page doesn't need to be reachable from anywhere but a management network. When it is, a single bad patch turns into 1,000 compromised devices.
What To Do
- Update every GS1900 to the 2.90 Patch 3 build for its model. Patch 2 is not enough. Check the Zyxel advisory for your exact model string.
- Get the web management interface off the internet. Put it on a dedicated management VLAN or behind an access broker that requires identity first.
- Change default credentials. Over half the hacked switches still had them. That's not a zero-day problem, that's a Tuesday problem.
- Assume compromise if a switch was exposed this summer. Binarly and GreyNoise point to backdoors on compromised devices. A firmware update may not remove an attacker who already has root. Reflash, reset credentials, and review configs.
- Don't treat "in KEV, patched" as closed. When a vendor patch lands for an exploited bug, watch for follow-up research on whether it actually holds.
Bottom Line
The fix everyone applied in June didn't fix the thing being exploited. Patch 3 is the real one, at least for now. And the boring advice still wins: if the admin page isn't reachable from the internet, nobody can send it a 140-parameter request.
Sources: SecurityWeek, The Hacker News, Binarly, Zyxel security advisory, and Help Net Security on the September compromises