Vulnerability Details
Zyxel announced the addressing of a serious "out-of-bounds write" security vulnerability in the web management interface of the GS1900 network switch series. The vulnerability carries the code CVE-2026-107441 and allows unauthorized attackers to remotely execute operating system commands via specially crafted HTTP requests.
Context of Attacks and Security Confusion
The story began in June 2026 when Zyxel released an update for a previous vulnerability (CVE-2026-7273). However, cybersecurity firm GreyNoise noticed in August 2026 activity from a threat group known as Kapibala, associated with the "Red Heron" campaign, where approximately 996 devices in 48 countries were compromised. Initially, researchers believed attackers were exploiting the vulnerability patched in June, but subsequent investigations conducted by Binarly revealed that attackers were targeting a completely separate vulnerability that had not been discovered at that time.
Why Does This News Matter?
The importance of this development lies in the attackers' ability to bypass previous security updates. Binarly researchers discovered that attackers used a Python script specifically targeting devices that had received CVE-2026-7273 updates. Attackers were able to bypass buffer overflow validation by corrupting the parameter counter before it was verified, allowing them to execute commands despite the presence of old patches.
What Changes Practically for Users?
On October 22, 2026, Zyxel released new software updates that restrict parameter sizes and verify their count before they are processed in memory, effectively closing the vulnerability. All network administrators using the ten affected GS1900 models are advised to install the latest firmware version immediately to ensure protection against these attacks that target the theft of configuration files and root credentials.