EXPLORINEER
en

DE — heise online

Patch now! Attacks on Zyxel switches observed

Security1 min read

Attacks are happening right now on Zyxel GS1900 network switches. Admins need to install the latest security updates to stay safe.

Attacks on Zyxel switches

Zyxel warns that attackers are currently targeting its GS1900 switches. If admins do not install the new security updates, attackers can get into the devices and copy login details. The flaw is tracked as CVE-2026-107441 and has a high risk rating (CVSS 8.8).

Key facts

  • GreyNoise reported 996 switches hacked in 48 countries.
  • Attackers took device settings and hashed root passwords.
  • CVSS 8.8 is a high risk score on a scale of 0 to 10.
  • Updates exist only for models that are still supported by Zyxel.

How the attack works

An attacker on the local network can send a specially built web request without logging in. This causes a memory error, which may let the attacker run system commands on the switch. GreyNoise first linked the attacks to an older flaw, CVE-2026-7273. Binarly later found that the same attack still worked after the fix for that older flaw, so the problem is now listed under the new number.

Why it matters

A network switch connects many computers and devices. If an attacker controls one, they may reach login data and other parts of the network. Canada's Cyber Centre has also warned about this flaw, so the threat is taken seriously. It is not yet known how widespread the attacks are.

What to watch

  • Check that your GS1900 switch model is still supported and install the listed firmware version.
  • Watch for new reports on how many devices are being attacked.
  • Read Binarly's report for details on how the attacks work.

Glossary

Zyxel
A company that makes network products such as switches and routers.
GS1900
A series of Zyxel network switches that connect devices in an office or home network.
CVE-2026-107441
The official code name for this security flaw, so people can talk about it clearly.
CVSS
A score from 0 to 10 that shows how serious a security flaw is.
GreyNoise
A security company that watches internet traffic to spot attacks.
Binarly
A security research company that studies how attacks on devices work.

Ad

Add 150 words. Learn 10 a day.

Dicter word books send only the words you learn to your review notes.

More in this topic

SecurityITmedia

Strengthening Cybersecurity at Medical Institutions: Long-Term Risks to Patient Care from Ransomware Attacks

Japan's Ministry of Health, Labour and Welfare plans to significantly strengthen cybersecurity at medical institutions next fiscal year, requesting 13.7 billion yen for the project in its FY2027 budget request, up from 100 million yen in the FY2026 initial budget. A ransomware attack can make electronic medical records unusable for long periods and disrupt patient care, and the ministry's survey found many hospitals have numerous external connection points that are hard to manage and lack cybersecurity specialists. The ministry will support consolidation of external connections, use of specialists listed by IPA, and initial response to incidents.

SecurityVnExpress

Hackers attack refrigeration systems at France's blood bank

Hackers targeted a refrigeration equipment supplier, raising storage temperatures at France's national blood agency (EFS) from -30°C to 110°C in three facilities in Bourgogne-Franche-Comté. A night-shift staff member noticed the abnormal rise and technical staff acted before any blood samples or products were damaged. EFS moved its products to other storage sites and is working with France's cybersecurity agency and the Ministry of Health on the investigation.

SecurityITmedia

Mos Burger, Workman, IIJmio Among Firms Announcing Customer Data Leaks from Unauthorized Access to Ararа

Companies using mail delivery service provider Arara are announcing customer data leaks linked to unauthorized access to the service. Mos Food Services (Mos Burger), Workman, IIJ, and Sumitomo Fudosan were among those announcing on November 4, with Arara estimating up to about 380 contracted companies may be affected. Mos Food Services reported that 7,517,087 records of its member data, including email addresses, were leaked, without payment card information.

SecurityITmedia

Failure to Notice a Published Vulnerability Led to Leak of 396,920 People's Data; Recruiting Service ApplyNow Also Exposed Some My Numbers and Bank Account Information

ApplyNow, a Tokyo-based recruiting service provider, announced on November 4 that the personal information of 396,920 people was leaked through unauthorized access to its services first disclosed on September 9. Some records included My Number, basic pension numbers, and bank account details, while credit card information and identity document images were not affected. The company attributed the breach to failing to apply a vendor-published patch to an internal data analysis tool in time, and it has since applied the fix and restricted access to specific IP addresses.