Zyxel Switch Attacks Used a Separate Zero-Day, Binarly Says

Attackers exploited a Zyxel GS1900 switch vulnerability in August and compromised nearly 1,000 devices, cybersecurity firm Binarly reported. Earlier reports had attributed the campaign to a different Zyxel flaw, CVE-2026-7273, which was patched in June.

The newly identified vulnerability is tracked as CVE-2026-107441 and has a CVSS severity score of 8.8. It affects 10 models in Zyxel’s GS1900 series. The flaw is an out-of-bounds write issue in the switches’ CGI program. An unauthenticated attacker can exploit it by sending specially crafted HTTP requests to execute operating system commands.

Binarly’s analysis found that the attackers used CVE-2026-107441 rather than CVE-2026-7273. Applying the earlier patch would not have protected devices from this campaign.

The attackers deployed variants of the Jitterly and Sixzut malware, which have been linked to attacks attributed to the Chinese threat actor Red Heron. The malware was installed after the attackers gained access to vulnerable switches.

Binarly notified Zyxel about the vulnerability on Sept. 29. Zyxel confirmed the flaw about two weeks later, released firmware updates on Oct. 23 and published a security advisory on Nov. 3.

CVE-2026-7273 was added to the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog after reports that about 1,000 devices had been compromised.

“Because the threat actor was exploiting a different vulnerability, and the patch for CVE-2026-7273 remained ineffective, this had no effect on protecting devices from being exploited by this threat actor,” Binarly wrote. The firm also called for software security checks that examine binary code, rather than relying only on vulnerability advisories and version numbers.