996 Zyxel Switches Were Hacked With an Exploit the June Patch Never Stopped

Patching is supposed to end the conversation. When a vulnerability is confirmed as exploited, the vendor has a fix, and CISA sets a deadline, network teams apply the update, tick the box, and move on. Owners of Zyxel GS1900 switches did exactly that this autumn, and it did not help. The exploit behind a campaign that compromised nearly a thousand of the switches turned out to target a different, unknown flaw, one the June firmware left wide open. For four weeks after the government's deadline, a fully patched switch was as exposed as an unpatched one.

A Campaign Pinned on the Wrong Bug

The story began in September. As Help Net Security reported, GreyNoise said a Chinese-speaking threat actor had exfiltrated data from 996 GS1900 Smart Managed Switches in 48 countries, with attacks on or about August 17. The haul was configuration data, networking information and hashed root-level credentials, with the heaviest concentrations in Italy, the United States, Taiwan and South Korea. GreyNoise tied the activity to CVE-2026-7273, a stack-based buffer overflow affecting firmware 2.90(XXXX.1)C0 and earlier that Zyxel had fixed in June, and linked the same actor to earlier WordPress and Gitea campaigns. CISA added the flaw to its Known Exploited Vulnerabilities catalog and gave federal civilian agencies until September 24 to remediate and check for indicators of compromise.

That attribution was the problem. According to SecurityWeek, Binarly concluded that the attackers deployed variants of the Jitterly and Sixzut malware Acronis had analyzed, but that their exploit went after a different, previously unknown vulnerability, and that "the patch for CVE-2026-7273 remained ineffective." Binarly notified Zyxel on September 29, and Zyxel confirmed the new flaw about two weeks later.

The Exploit Ran on Every Patched Release

Binarly's evidence came from the attacker's own infrastructure. Help Net Security reports that the researchers found an open directory on a command-and-control server holding an archive with a Python 3.10 exploit, obfuscated with PyArmor, aimed at the switch's dispatcher CGI. Run against the firmware, it achieved unauthenticated command execution on all ten releases that included Zyxel's June fix, which suggests the attackers may never have relied on CVE-2026-7273 at all. Binarly believes the exploit was generated with a large language model, and it was blunt about the lesson: "Advisories and version numbers certainly help, but they cannot be blindly trusted."

Zyxel's advisory, published November 3 and crediting Yegor Vasilenko of Binarly, describes CVE-2026-107441 as an out-of-bounds write in the GS1900 CGI program that could let a LAN-based, unauthenticated attacker run operating system commands with a crafted HTTP request. It lists ten models, from the GS1900-8 to the GS1900-48HPv2, each vulnerable through its 2.90(xxxx.2)C0 build, which is the June release, and fixed in the matching .3C0 build. The advisory adds that patches are provided only for models still inside their vulnerability support period.

The timeline is what should worry network teams. CSO Online puts the firmware release at October 22, with the advisory following on November 3, and rates the flaw CVSS 8.8. That means agencies that met CISA's September 24 deadline spent roughly a month believing they were remediated while the exploit seen in the wild still worked against them, and the advisory explaining why arrived another twelve days after the firmware. CSO's guidance is plain: update every affected GS1900 switch, including those already patched in June.

Default Passwords and Version Numbers Gave False Comfort

The patch failure was not the only weakness. GreyNoise found that 564 of the victim switches, more than half, still had factory default credentials, so a meaningful share of the fleet would have been open to an attacker even with perfect firmware. These are smart managed switches, the kind that sit quietly in branch offices and wiring closets, rarely logged into and rarely monitored, and the stolen hashed root credentials and network maps are exactly what an intruder needs to move further into an environment.

The broader point is about evidence. A vulnerability scanner that checks firmware versions would have marked every June-patched GS1900 as clean. Binarly argues that analyzing binary code is the definitive way to tell whether a component is still vulnerable, and the Zyxel case shows why: the version string said fixed, and the device was not. For edge and access hardware, "patched" has to be treated as a claim to verify, not a fact.

• Upgrade every GS1900 to the .3C0 build. Treat June-patched switches as vulnerable, and confirm each of the ten listed models is on 2.90 Patch 3 firmware rather than trusting earlier remediation records.
• Assume compromise where switches were reachable. Any switch exposed since mid-August may have handed over its configuration and hashed root credentials, so check for indicators of compromise before calling it clean.
• Rotate credentials and kill defaults. Replace factory passwords on every switch, and rotate any credentials stored in configurations the attacker could have read.
• Pull management interfaces off untrusted networks. The flaw needs only network access to the web interface, so restrict it to a dedicated management VLAN or jump host.
• Revisit closed tickets for exploited flaws. When a vendor issues a second fix for an exploited bug, reopen the original remediation and verify it against the new advisory rather than the old one.
• Find models outside support. Zyxel patches only models inside their vulnerability support period, so inventory any GS1900 units that will never receive the fix.

The GS1900 campaign will be remembered less for the exploit than for the paperwork around it: a confident attribution, a federal deadline, and a patch that administrators applied in good faith. Every one of those signals pointed the wrong way for more than a month. The organizations that came through it were the ones that kept watching their switches after the box was ticked.