# Zyxel GS1900 Switch Zero-Day (CVE-2026-107441) Exploited by Kapibala in Red Heron Campaign, ~1,000 Switches Compromised

> Zyxel fixed an out-of-bounds write in the CGI program of GS1900 series switches (CVE-2026-107441) that lets an unauthenticated attacker execute OS commands via crafted HTTP requests, including on firmware already patched against CVE-2026-7273. A suspected Chinese-speaking actor tracked as Kapibala (Red Heron campaign) compromised 996 switches across 48 countries, collecting configurations, hashed root credentials and network information.

- **Published:** 2026-11-04T21:31:50Z
- **Last reviewed:** 2026-11-04T21:31:50Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5271
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5271.png
- **ID:** TL-2026-5271
- **Severity:** CRITICAL
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** Kapibala
- **Detections:** 9 (1 shown free below) · **IOCs:** 9
- **CVEs:** CVE-2026-107441, CVE-2026-7273

## Description

CVE-2026-107441 is an out-of-bounds write in the CGI program of the web management interface of Zyxel GS1900 series Smart Managed Switches. Zyxel's advisory of 2026-11-03 states that a LAN-based, unauthenticated attacker can exploit it with a crafted HTTP request to potentially execute OS commands. The advisory lists ten models (GS1900-8, -8HP, -10HP, -16, -24, -24E, -24EP, -24HPv2, -48, -48HPv2) as vulnerable at firmware 2.90(xxxx.2)C0 and earlier, with fixes at 2.90(xxxx.3)C0. No CVSS score was published; the CRITICAL severity here is analyst-assigned based on unauthenticated code execution and confirmed mass exploitation. Note that Zyxel describes the attack vector as LAN-based, while the observed campaign compromised switches in the wild at scale, so exposure of the management interface beyond the LAN should be assumed possible and verified.

The flaw is a bypass of the earlier fix for CVE-2026-7273 (a pre-authentication stack-based buffer overflow in the same CGI program, patched 2026-06-16, CVSS 8.8, added to the CISA KEV catalog on 2026-09-21). Binarly (researcher Yegor Vasilenko) analysed an exposed archive containing a PyArmor-obfuscated Python exploit used in the attacks, confirmed on 2026-09-28 that it still worked against firmware patched for CVE-2026-7273, and reported it to Zyxel on 2026-09-29. According to the BleepingComputer report, the earlier patches added overflow checks but missed validation of HTTP parameter lengths: the attacker corrupts a parameter counter before validation, which defeats the checks and enables a memory overwrite and command execution without authentication. The exploit explicitly checked for firmware versions patched for CVE-2026-7273, indicating deliberate targeting of patched devices. The exploit script exposed command-line options for targeting different firmware versions and base addresses.

GreyNoise reported that exploitation of CVE-2026-7273 began around 2026-08-17 and that a suspected Chinese-speaking actor compromised 996 switches in 48 countries (Italy, United States, Taiwan with 123 devices, France, South Korea and others), mostly in small offices, schools, hotels and retail shops. After exploitation the attacker used TFTP to retrieve and run a custom collector script and exfiltrated device configuration files, hashed root-level credentials and networking information; 564 of the devices still used factory-default credentials. BleepingComputer attributes the activity to Kapibala in the Red Heron campaign and names the JITTERLY backdoor and SIXZUT rootkit as associated malware; public technical detail on those two families was not found in the sources reviewed. GreyNoise's Red Heron cluster has also been linked in secondary reporting to WordPress exploitation (the 'WP2Shell' chain) and Gitea CVE-2026-60004. No network IOCs (IPs, domains, hashes) have been published; GreyNoise withheld the attacker IP due to victim sensitivities.

Defenders should upgrade all GS1900 switches to the .3)C0 firmware, restrict the web management interface to a dedicated management network, rotate all credentials (especially factory defaults), review switch configurations for unexpected changes, and hunt for outbound TFTP from switches and anomalous HTTP requests to the management CGI.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059.004 Unix Shell
- T1027 Obfuscated Files or Information
- T1014 Rootkit
- T1005 Data from Local System
- T1119 Automated Collection
- T1602.002 Network Device Configuration Dump

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Zyxel GS1900 Collector Retrieval — Outbound TFTP (UDP/69) to Non-Private Destinations** (`TL-2026-5271-SPL-003`)

Detects TFTP traffic from internal devices to non-RFC1918 destinations. After exploiting GS1900 switches, Kapibala (Red Heron) used TFTP to retrieve and run a custom collector script and exfiltrate configuration, hashed root credentials and network information. Switches should never speak TFTP to the internet.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1105, T1041
- **Data sources:** pan:traffic, fortinet_traffic, cisco_asa, CommonSecurityLog
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=network sourcetype IN ("pan:traffic","fgt_traffic","cisco:asa") ((dest_port=69 AND transport=udp) OR app=tftp)
| where NOT (cidrmatch("10.0.0.0/8",dest_ip) OR cidrmatch("172.16.0.0/12",dest_ip) OR cidrmatch("192.168.0.0/16",dest_ip))
| stats count AS sessions sum(bytes_out) AS bytes_out sum(bytes_in) AS bytes_in values(dest_ip) AS tftp_servers earliest(_time) AS first_seen latest(_time) AS last_seen BY src_ip
```

### Microsoft KQL

```kql
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DestinationPort == 69 and tolower(Protocol) in ("udp", "17")
| where not(ipv4_is_private(DestinationIP))
| summarize Sessions = count(), BytesOut = sum(SentBytes), BytesIn = sum(ReceivedBytes), TftpServers = make_set(DestinationIP), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DeviceVendor
| project FirstSeen, LastSeen, SourceIP, Sessions, BytesOut, BytesIn, TftpServers, DeviceVendor
```

### Sigma

```yaml
title: Outbound TFTP to Non-Private Destination (Zyxel GS1900 Kapibala Collector Retrieval)
id: a4f2c8d3-1e57-4b90-9c36-0d8e7f6a5303
status: experimental
description: Detects UDP/69 TFTP traffic to a non-private destination, used by Kapibala (Red Heron) to pull the collector script onto compromised Zyxel GS1900 switches and send back configuration data.
references:
    - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026
    - https://www.bleepingcomputer.com/news/security/zyxel-fixes-zero-day-exploited-to-hack-nearly-1-000-network-switches/
    - https://www.helpnetsecurity.com/2026/09/22/zyxel-switches-cve-2026-7273-vulnerability-exploited/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/04
tags:
    - attack.command-and-control
    - attack.t1105
    - attack.exfiltration
    - attack.t1041
    - cve.2026.107441
logsource:
    category: firewall
detection:
    selection:
        dst_port: 69
    filter_internal:
        dst_ip|cidr:
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
    condition: selection and not filter_internal
falsepositives:
    - Legitimate PXE or VoIP phone provisioning against a cloud TFTP service
    - Vendor-hosted firmware retrieval
level: high

```

**Known false positives:**

- Cloud-hosted TFTP provisioning for VoIP phones or PXE
- Vendor-hosted firmware retrieval over TFTP

**Tuning notes:** Allowlist known provisioning servers by dest_ip. Tighten to sources in the GS1900 switch inventory for highest fidelity, and escalate when bytes_out is non-trivial (config exfiltration). Add your own private/CGNAT ranges (e.g. 100.64.0.0/10) to the exclusion.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Zyxel GS1900 Exploit Payload — Shell Metacharacters and Tooling Strings in Management CGI Requests (locked: unlock with TL Creds)
- Zyxel GS1900 Collector Behaviour — Configuration and Credential File Collection in Switch Syslog (locked: unlock with TL Creds)
- Zyxel GS1900 Exploit-to-Collector Chain — CGI Anomaly Followed by Switch-Originated TFTP (locked: unlock with TL Creds)
- Zyxel GS1900 Mass Exploitation — External Source Probing Management CGI on Multiple Hosts (locked: unlock with TL Creds)
- PyArmor Runtime Artifacts Written to Disk (Obfuscated Kapibala Exploit Tooling) (locked: unlock with TL Creds)
- Zyxel GS1900 Rootkit Indicators — Kernel Module Loading in Switch Syslog (SIXZUT) (locked: unlock with TL Creds)
- Zyxel GS1900 CVE-2026-107441 Exploit Trigger — Anomalous Management CGI Requests (locked: unlock with TL Creds)
- Zyxel GS1900 Post-Exploitation — JITTERLY/SIXZUT Names or TFTP Fetch-and-Execute in Switch Syslog (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Zyxel fixes zero-day exploited to hack nearly 1,000 network switches](https://www.bleepingcomputer.com/news/security/zyxel-fixes-zero-day-exploited-to-hack-nearly-1-000-network-switches/)
- [Zyxel security advisory for out-of-bounds write vulnerability in GS1900 series switches (CVE-2026-107441)](https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026)
- [Zyxel security advisory for stack-based buffer overflow vulnerability in GS1900 series switches (CVE-2026-7273)](https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-stack-based-buffer-overflow-vulnerability-in-gs1900-series-switches-06-16-2026)
- [CISA orders feds to patch actively exploited Zyxel flaw by Thursday](https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-actively-exploited-zyxel-flaw-by-thursday/)
- [Attacker compromised nearly 1000 Zyxel switches since August (CVE-2026-7273)](https://www.helpnetsecurity.com/2026/09/22/zyxel-switches-cve-2026-7273-vulnerability-exploited/)
- [Zyxel and Veeam flaws under active exploitation](https://thehackernews.com/2026/09/zyxel-and-veeam-flaws-under-active.html)
- [Canadian Centre for Cyber Security: Zyxel security advisory AV26-603](https://cyber.gc.ca/en/alerts-advisories/zyxel-security-advisory-av26-603)
- [Tenable CVE-2026-7273](https://www.tenable.com/cve/CVE-2026-7273)
- [INCIBE-CERT early warning: CVE-2026-7273](https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-7273)
- [U.S. CISA adds Zyxel flaw to its Known Exploited Vulnerabilities catalog](https://securityaffairs.com/?p=199518)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5271