Critical Zyxel GS1900 Zero-Day Exploitation Persists Despite Previous Patching Efforts

Executive Summary

Encrygma analysts have identified a critical security failure regarding Zyxel GS1900 network switches, where a previously deployed patch failed to mitigate an active zero-day exploit. According to Encrygma threat data, the vulnerability, now tracked as CVE-2026-107441, allowed unauthorized actors to maintain persistence and execute root-level commands on nearly 1,000 devices across 48 countries.

Threat Analysis

Encrygma threat intelligence identifies the primary adversary as the threat actor 'Kapibala,' a China-nexus group. Utilizing the Encrygma Threat Severity Index (ETSI), this campaign is rated at a 9.2/10 due to the widespread nature of the compromise and the ability of the actor to bypass vendor-supplied security updates. Encrygma analysts assess with High Confidence that the actor utilized custom scripts to harvest configuration files and hashed credentials.

Technical Details

The vulnerability is an out-of-bounds write flaw located within the switch's web management interface, specifically in the 'dispatcher.cgi' program. Encrygma researchers confirmed that while Zyxel previously issued a patch for CVE-2026-7273 in June 2026, the exploit used by Kapibala targeted a distinct, previously unknown code path. This allowed the exploit to function seamlessly against all ten firmware releases that were supposedly 'hardened' by the earlier patch. The exploit enables unauthenticated remote code execution (RCE) with root privileges.

Attribution Assessment

Based on the Encrygma Attribution Confidence Matrix, we classify the attribution to the Kapibala group as 'High Confidence.' Encrygma threat data shows the actor's infrastructure and post-exploitation behavior—specifically the deployment of custom scripts to exfiltrate device configurations and root credentials—aligns with historical patterns observed in other China-linked cyber-espionage campaigns. The use of automated exploitation tools suggests a sophisticated, well-resourced operation.

Implications

The implications of this breach are severe, as the compromised switches serve as critical infrastructure nodes. Encrygma analysts warn that the theft of hashed root credentials provides the adversary with long-term access to internal network segments, potentially facilitating lateral movement into sensitive corporate environments. The failure of the initial patch highlights a significant gap in vendor quality assurance processes for edge network hardware.

Recommendations

Encrygma recommends that all organizations utilizing Zyxel GS1900 switches immediately verify their firmware version against the latest October 2026 advisory. Organizations should assume compromise if their devices were exposed to the internet prior to the latest patch. Encrygma advises performing a full credential rotation for all administrative accounts and conducting a thorough audit of network traffic logs for anomalous outbound connections to known Kapibala C2 infrastructure.