A recent hacking campaign targeting Zyxel switches has been linked to a previously unknown vulnerability, not the patched flaw initially reported. Cybersecurity firm Binarly revealed that nearly 1,000 devices were compromised using an exploit that took advantage of a zero-day vulnerability in the CGI program of Zyxel’s GS1900 series switch firmware.
The vulnerability, tracked as CVE-2026-107441, has a CVSS score of 8.8 and is considered a high-risk issue. It allows an unauthenticated attacker to execute OS commands via crafted HTTP requests. Zyxel had patched a different flaw, CVE-2026-7273, in June, but the new exploit targeted this previously unknown vulnerability.
Binarly notified Zyxel of its findings on September 29, and two weeks later, the vendor confirmed the existence of the new vulnerability. The company analyzed the malware variants used in the attacks, which were identified as Jitterly and Sixzut, both analyzed by Acronis. However, it’s clear that the attackers did not target CVE-2026-7273, but instead exploited a previously unknown vulnerability.
This incident highlights the challenges of relying solely on patched vulnerabilities for protection. Advisories and version numbers can be misleading, as demonstrated in this case where the patch for CVE-2026-7273 remained ineffective against the new exploit. Binarly emphasizes the need for a more reliable way to assess vulnerabilities in software, suggesting that examining binary code is the definitive method.
This case also raises questions about the effectiveness of relying on publicly disclosed vulnerabilities as a benchmark for security. If attackers can find and exploit previously unknown vulnerabilities, does it mean that the current patching model is insufficient? The cybersecurity community must consider these issues and work towards improving vulnerability management practices to stay ahead of emerging threats.
In practical terms, this incident serves as a reminder to stay vigilant and keep software up-to-date, but not solely rely on patched vulnerabilities for protection. Users should be aware that even with the latest patches, vulnerabilities can still exist, and exploit kits can target these gaps. This underscores the importance of continuous monitoring and regular security audits to ensure that systems are secure against emerging threats.
As the cybersecurity landscape continues to evolve, it’s essential to address the limitations of current patching models and explore new methods for vulnerability assessment and management. By doing so, we can better protect against emerging threats and stay ahead of attackers who continue to exploit previously unknown vulnerabilities.
Source: SecurityWeek — 2026-11-05