Cybersecurity firm Binarly has revealed that approximately 1,000 "GS1900" series network switches manufactured by Zyxel have been compromised through a previously unknown zero-day vulnerability. This discovery corrects earlier security reports that attributed the attacks to the exploitation of an older vulnerability that had already been fixed, highlighting the risks of relying entirely on surface-level patches without inspecting the executable code of devices.
Vulnerability Details and Exploitation Path
The new vulnerability is designated as CVE-2026-107441 and received a severity score of 8.8 according to the Common Vulnerability Scoring System (CVSS). The issue centers around an out-of-bounds write flaw within the CGI program embedded in the firmware of Zyxel GS1900 devices.
According to technical data released by the manufacturer, the vulnerability allows an unauthenticated attacker to send carefully crafted HTTP requests to execute commands directly at the operating system level of the device without requiring administrative privileges. This security issue affects 10 different models within the mentioned series.
Correcting Attack Attribution and Previous Analyses
Security research firm GreyNoise had detected the attack campaign last September and attributed it to the exploitation of a previous vulnerability bearing the code (CVE-2026-7273), for which Zyxel had released a security update in June. Those attacks were linked to a Chinese threat group known as "Red Heron," prompting the US Cybersecurity and Infrastructure Security Agency (CISA) to add the old vulnerability to its Known Exploited Vulnerabilities (KEV) catalog.
However, recent binary analyses conducted by Binarly proved that the attackers used the new vulnerability (CVE-2026-107441) to deploy variants of the "Jitterly" and "Sixzut" malware. Since the security updates applied for the old vulnerability did not include patching the code affected by the new vulnerability, devices that appeared protected remained vulnerable to actual compromise.
Why This News Matters
This development highlights the fundamental difference between tracking official updates and actually inspecting binary code. The significance is distributed across the following points:
- Inadequacy of relying on version numbers: Addressing a known vulnerability does not necessarily mean protecting the device if the attacker is exploiting an unannounced vulnerability in the same component.
- Risks of targeting infrastructure: Compromising network switches gives attackers a strategic foothold to control data flow and take over enterprise networks.
- Remediation timeline: Binarly reported the vulnerability to the manufacturer on September 29, and Zyxel issued patches on October 23 before publishing the official advisory on November 3.
This incident underscores the necessity of adopting deeper inspection mechanisms for source code and firmware, rather than relying solely on matching version numbers issued by vendors to secure sensitive networks.