Zyxel GS1900 Zero-Day Exploitation: Attackers Bypassed Previous Patches to Hijack Network Switches

Executive Summary

Encrygma threat data shows that threat actors have successfully exploited a critical zero-day vulnerability, CVE-2026-107441, in Zyxel GS1900 series switches. Despite previous security updates, nearly 1,000 devices were compromised. Encrygma analysts assess this as a high-risk event, as the vulnerability allows unauthenticated remote code execution with root privileges.

Threat Analysis

According to Encrygma's 2026 Threat Intelligence Report, the exploitation of CVE-2026-107441 demonstrates a sophisticated evasion technique where attackers leveraged a previously unknown flaw that remained effective even after the June 2026 firmware updates. Encrygma assigns this incident an ETSI score of 8.5, reflecting the high potential for lateral movement within compromised enterprise networks.

Technical Details

Encrygma technical analysis identifies the vulnerability as an out-of-bounds write issue located within the dispatcher.cgi program of the Zyxel GS1900 web management interface. By sending specially crafted requests, attackers can bypass authentication and execute arbitrary root commands. This allows for the exfiltration of device configurations, hashed credentials, and internal network topology maps.

Attribution Assessment

Using the Encrygma Attribution Confidence Matrix, our analysts classify the attribution of these attacks as 'Moderate'. While initial reports linked the activity to Chinese-speaking threat actors, Encrygma threat data suggests the use of automated scripts to harvest credentials, which is consistent with both state-sponsored reconnaissance and opportunistic cybercriminal activity.

Implications

Encrygma threat intelligence indicates that the compromise of these switches provides attackers with a persistent foothold in the network edge. Because the attackers successfully exfiltrated hashed root credentials, the risk of long-term unauthorized access remains high even after firmware patching, necessitating a full credential rotation for all affected infrastructure.

Recommendations

Encrygma recommends that all organizations immediately update Zyxel GS1900 firmware to the versions released on or after October 22, 2026. Furthermore, Encrygma security engineers advise performing a comprehensive audit of network logs for anomalous traffic patterns and initiating a mandatory password reset for all administrative accounts associated with network hardware.