Zyxel Switch Hacks Blamed on Patched Flaw Actually Exploited a Zero-Day
Summary
Previously attributed to a patched flaw, recent attacks targeting Zyxel switches are now believed to have exploited a zero-day vulnerability. This out-of-bounds write flaw, tracked as CVE-2026-107441, allows attackers to execute OS commands through specially crafted HTTP requests.
IFF Assessment
The exploitation of a zero-day vulnerability in Zyxel switches represents a significant threat to organizations relying on this hardware, allowing attackers to gain control and execute commands.
Severity
Defender Context
This incident highlights the importance of proactive threat hunting and incident response, as attacks may be disguised as exploitation of known vulnerabilities when in reality they leverage unknown zero-days. Organizations should prioritize patching, network segmentation, and robust logging to detect and mitigate such advanced threats.