Network switches are the boxes nobody thinks about. They sit in a cupboard, connect every computer and printer in the office, and run for years without anyone logging in. That is exactly why attackers like them, and why a campaign against one popular small-business model this fall went unnoticed for weeks.
What happened
In June, Zyxel fixed a flaw in the web management program of its GS1900 switches (CVE-2026-7273). By mid-August, attackers were exploiting it anyway. GreyNoise found that on or about 17 August, 996 switches were broken into and had data taken: their configuration, root-level password hashes and details about the network around them. CISA added the June flaw to its list of actively exploited vulnerabilities on 21 September.
Then the researchers at Binarly found the attackers' exploit on one of their servers and tried it against the patched firmware. It still worked, without a single change. The June fix had added a limit on how many parameters a request could carry, but the exploit corrupted the counter before the check ran, so the check never triggered. Binarly reported it to Zyxel on 29 September, Zyxel treated it as a new flaw, and fixed firmware for ten GS1900 models shipped on 22 October. Binarly also says it believes the exploit was written with the help of an AI model.
No source says the switches were turned into a botnet or proxy network. What has been published describes theft: of configurations, credentials and maps of victims' networks, the kind of material an attacker collects before going further.
Why it matters
Switches hold more than people think. A switch's configuration describes how a network is laid out, which systems are where, and often how to reach them. Its administrator password is frequently reused on other network equipment. Stealing both is reconnaissance for whatever comes next.
Default passwords did more damage than the flaw. More than half the compromised switches still had the password they shipped with. Changing it would not have stopped this exploit, which needs no login at all, but it is a sign of how rarely these devices are looked at, and it means the stolen configurations give attackers working credentials.
"Patched" was not safe. Owners who did everything right in June were still exposed for four more months. That is not a reason to stop patching. It is a reason not to rely on patching alone for devices whose management pages are reachable from untrusted networks.
What to actually do
Find out whether you have a GS1900. Ask your IT provider, or look at the label on the switches in your network cupboard. Affected models are the GS1900-8, -8HP, -10HP, -16, -24, -24E, -24EP, -24HPv2, -48 and -48HPv2.
Install the October firmware. The fixed versions end in ".3)C0", for example 2.90(AAHL.3)C0 for the GS1900-24. Zyxel only supplies fixes for models still within their support period, so if yours is older, plan to replace it.
Take the management page off untrusted networks. A switch's web interface should only be reachable from a management network or a few administrators' computers, never from the internet or the guest Wi-Fi.
Change the passwords, and assume the old ones are known. Change the switch's administrator password from the default if it is still set, and if the switch was exposed since August, change it anyway, along with any other device that used the same password.
Put switches on the list. Every network device, including switches, access points and firewalls, needs an owner, a known firmware version and someone checking for updates. If nobody has logged into your switches in years, that is the first thing to fix.
The summary
Nearly a thousand switches were broken into through their management pages, most of them still using factory passwords, and many of them already patched against the flaw their owners had been told about. The new fix closes the hole. The habits that would have limited the damage are older and cheaper: keep management pages off untrusted networks, change default passwords, and know what equipment you have.
Sources
- Zyxel security advisory for out-of-bounds write vulnerability in GS1900 series switches — Zyxel
- Zyxel GS1900 RCE, CVE-2026-107441 — Binarly
- Open Season on Kapibala: attacker steals government records through WordPress exploitation — GreyNoise
- Zyxel fixes zero-day exploited to hack nearly 1,000 network switches — BleepingComputer
- Zyxel switch hacks blamed on patched flaw actually exploited a zero-day — SecurityWeek
- CVE-2026-107441 — NIST National Vulnerability Database
