996 Zyxel Switches Hacked Through a Bug Patched Since June

An unauthenticated attacker within reach of a Zyxel GS1900 switch's management interface, no login required, could send one crafted HTTP request and run commands on the device (the flaw needs only adjacent-network access, not credentials or a click from anyone). Zyxel patched it, tracked as CVE-2026-7273, on June 16. Security firm GreyNoise says someone was still exploiting it against 996 switches in 48 countries as of Sept. 17.

What GreyNoise found on 996 switches

GreyNoise's research, published Sept. 22 under the title "Open Season on Kapibala," counted 996 compromised Zyxel GS1900 Smart Managed Switches across 48 countries, with activity running from Aug. 17 through Sept. 17. Italy accounted for 133 of the victims, the United States 129 and Taiwan 123. Of the 996, 564 were still running Zyxel's factory-default credentials, meaning the buffer-overflow exploit was not even the attacker's only way in, only the way to escalate once inside on the rest.

Country	Compromised switches
Italy	133
United States	129
Taiwan	123

The exploit chain, once inside

Attackers ran a Python script obfuscated with PyArmor, a commercial code-protection tool, to trigger the buffer overflow in the switch's CGI program, a flaw Zyxel's advisory classifies as CWE-121 and which carries a CVSS score of 8.8 with a vector requiring adjacent-network access, no authentication and no user interaction. From there, the script ran a command to fetch a collector script over TFTP, the decades-old file transfer protocol, and used it to pull each switch's configuration, networking details and hashed root-level credentials back to the attacker's own server.

A same-network bug that reached 48 countries

The CVSS vector assumes an attacker already on the same network segment as the switch, not one reaching it over the open internet. GreyNoise's count of 996 victims spread across 48 countries only squares with that if a large share of those management interfaces sit on the public internet rather than behind a firewall. ZoomEye, a device-search engine, separately indexes 5,920 devices matching the GS1900 fingerprint as reachable online, nearly six times GreyNoise's victim count, though that figure counts anything matching the fingerprint rather than confirmed-vulnerable, internet-facing firmware.

Whose fingerprints are on the code

GreyNoise attributes the campaign to "a suspected Chinese speaker possibly working in UTC+8," based on the operational timing of the attacks and what its post calls "copious amounts of Chinese language comments" inside the attacker's own tools. The firm ties the actor to the "Red Heron" cluster reported separately by security company Acronis, citing shared command-and-control domains and malware, and to a July exploitation of Gitea repository servers tracked as CVE-2026-60004. None of that amounts to a named government sponsor, and GreyNoise's post does not claim one.

What owners should do now

Zyxel shipped fixed firmware for all ten affected GS1900 models on June 16, three months before GreyNoise published its findings, a gap that echoes CISA's own recent scoring dispute over a Linux kernel flaw: a patch existing is not the same as a patch installed. CISA added CVE-2026-7273 to its Known Exploited Vulnerabilities catalog Sept. 21, setting a Sept. 24 deadline for federal agencies, a timeline that runs even shorter than the one CISA gave for a separately patched flaw in lwIP this month. Owners of any of the ten GS1900 models should install the June firmware and change any switch still using its factory default password, since more than half of GreyNoise's victims never got past that first step.