[REVISION HISTORY]

Zyxel Networks cybersecurity and product developments

1 recorded revision of this situation.

What changed

2026-11-05 10:23 UTC → 2026-11-07 22:06 UTC · added ~~removed~~

In October 2026, Zyxel Networks launched a cybersecurity campaign and a new series of XS1935 smart managed multi-gigabit 10G Lite-L3 switches. This initiative was intended to assist small and medium-sized enterprises with high-performance networking and simplified security management. By November 2026, the company released firmware updates to patch a zero-day vulnerability, identified as CVE-2026-107441, affecting ten models of GS1900 network switches. The flaw, which carries a CVSS score of 8.8, allowed unauthenticated attackers to execute operating system commands via the web management interface. Security researchers reported that attackers had been exploiting these switches since mid-August, targeting nearly 1,000 devices across 48 countries to collect network information and hashed root credentials. Reports indicate that a cyber threat group identified as Kapibala exploited this vulnerability to compromise 996 devices. The campaign targeted various small to medium-sized enterprises, such as schools, hotels, and offices. In at least 564 cases, attackers successfully exploited devices that were still using factory default passwords. While a previous patch had been issued in June, the new exploit targeted a different aspect of the management component, allowing remote attackers to execute arbitrary code via specially crafted HTTP requests.

Versions

Select a version to see what changed compared to the one before it.