Zyxel fixes zero-day exploited to hack nearly 1,000 network switches

What happened?

Zyxel has patched a zero-day vulnerability in its GS1900 series network switches that hackers exploited to compromise nearly 1,000 devices worldwide and steal configuration files and credentials. [...]

Key details

• Zyxel GS1900 switches were exploited via a zero-day flaw to compromise nearly 1,000 devices globally.
• The vulnerability CVE-2026-107441 is an out-of-bounds write in the web management interface allowing unauthenticated command execution.
• Attacks began around August 17 by a threat actor tracked as Kapibala linked to the Red Heron campaign.
• The exploit collected device configurations, hashed root credentials, and network information after gaining access.
• The earlier patch added buffer overflow checks but attackers could bypass them by corrupting a parameter counter before validation.
• Zyxel released new firmware on October 22 limiting parameter sizes and validating parameter count before copying data into memory.

Summarised by SecOraLens from BleepingComputer. Always read the original source before acting. How SecOraLens verifies advisories.