The campaign exposed a patching blind spot
The GS1900 campaign wasn't really about the bug everyone blamed. Attackers compromised 996 Zyxel switches across 48 countries using a zero-day hiding behind a fix Zyxel had already shipped, and the June patch did nothing to stop it. That distinction matters: a device can be updated and still remain exposed when defenders are tracking the wrong weakness.
For administrators, the incident is a reminder that patch status isn't a simple yes-or-no check. A system may have received an update tied to a known flaw while a separate, undisclosed vulnerability remains exploitable. The campaign also shows how an early attribution can shape the response: once investigators connect activity to a specific vulnerability, defenders may focus on that issue and treat the related patch as the necessary remedy.
The wrong bug got the blame
GreyNoise dated the start of the activity to around August 17 and initially pointed at CVE-2026-7273, a buffer overflow Zyxel patched in June. That attribution was enough to get the flaw listed in CISA's Known Exploited Vulnerabilities catalog in September. Binary's researchers, however, found an exploit aimed at a different weakness, and it still worked on switches running the June updates. They reported it to Zyxel on September 29.
The sequence illustrates a difficult part of incident analysis: observed malicious activity and the vulnerability that enabled it aren't always the same thing. Investigators often have to infer the entry point from available evidence, and an exploit that resembles a known issue can point attention in the wrong direction. Here, the later research identified a separate flaw that remained usable after the earlier fix.
That doesn't make the initial attribution unreasonable based on the information then available. It does show why a patch associated with an incident shouldn't be treated as proof that the device is safe. If you're working in this space, the practical question is whether the relevant software version addresses the vulnerability now known to be involved, not whether the machine received some update.
What the new flaw does
Tracked as CVE-2026-107441, the bug is an out-of-bounds write with a CVSS score of 8.8, sitting in the switches' web management interface. Unauthenticated attackers with network access can run operating system commands through crafted HTTP requests. Ten GS1900 models are affected, including the GS1900-8, GS1900-24 and GS1900-48. Zyxel lists firmware ending in .2C0 and earlier as vulnerable, with model-specific fixes in versions ending in .3C0.
The combination of network reachability and no authentication requirement makes the management interface the key point for defenders to review. A web interface is intended to let administrators configure equipment; when a flaw in that interface permits command execution, the consequence can extend beyond changing a setting. The source doesn't establish how every compromised switch was exposed, so administrators shouldn't assume that all affected devices were reachable in the same way.
The attackers' script pulled device configurations, hashed root credentials and network details. That's not destruction, but it's a useful map. With it, an intruder can plan lateral movement deeper into the network without much guesswork.
Credential hashes aren't the same as plaintext passwords, and the source doesn't say they were cracked or reused. Still, their collection alongside configuration and network information raises the stakes beyond the switch itself. Those details can help an attacker understand how a network is arranged and where other systems may be reachable. A foothold with a view of the network can be valuable even when the initial activity doesn't visibly disrupt service.
A map of the network. That's the part most people overlook.
What administrators should do
Zyxel shipped firmware updates on October 22 and published its advisory on November 3. The catch is that a June update doesn't count. Any GS1900 running firmware ending in .2C0 or earlier needs the .3C0 build, including units that already received the June fixes. Check the firmware version directly rather than assuming the earlier patch covered you.
Administrators should first identify whether they have one of the affected GS1900 models, then compare its installed firmware with Zyxel's model-specific fixed version. The suffix is the useful detail in the advisory: the source identifies .2C0 and earlier as vulnerable and .3C0 as the fixed release. Since the fixes are model-specific, teams should match the version to the exact switch model instead of applying one model's instructions across an entire fleet.
Where a device is exposed to networks beyond the intended administrative audience, reviewing its reachability is also sensible. That review doesn't replace installing the fixed firmware, but it can help identify how an attacker could have reached the management interface. Because the campaign involved data collection, organizations that find an affected device should also consider what its configuration and network details reveal about connected systems.
Here's the thing: a firmware update is only reassuring when it closes the vulnerability that matters. The June patch addressed the flaw first associated with the activity; it didn't address the separate weakness later identified by Binary's researchers.
Why the distinction matters
The count of 996 compromised switches across 48 countries indicates that this wasn't a narrowly contained incident. It doesn't, by itself, establish how many organizations were affected, how the devices were exposed, or whether attackers reached other systems. Those limits matter. The available facts support concern about the access and information collected, but they don't justify claims about damage that hasn't been described.
For security teams, the broader lesson is about how vulnerability response changes as evidence improves. An initial explanation can be useful and still turn out to be incomplete. When researchers identify a different exploit path, asset owners need to revisit the original assumptions, check the affected versions, and make sure their remediation matches the newly identified flaw.
This is more significant than it looks. The campaign shows how a familiar patch can create false confidence when teams track fixes by date or headline rather than by the specific vulnerability and firmware version. The concrete next step is clear: verify every GS1900 against Zyxel's affected-model and firmware guidance, then install the applicable .3C0 update where needed.
