Attackers Exploit Zero-Day in Zyxel Switches for OS Command Execution

En bref

• Attackers are actively exploiting an unpatched Zyxel switch vulnerability.
• CVE-2026-107441 allows OS command execution and can lead to full switch compromise.
• Some early reporting incorrectly tied the issue to an already-fixed flaw.
• School and public-sector networks with Zyxel switches should verify exposure now.

Attackers are actively abusing an unpatched security flaw in Zyxel switches, tracked as CVE-2026-107441, to run commands on the underlying operating system. The intrusion path involves specially formed HTTP requests sent to exposed switch interfaces, according to the available facts. Successful exploitation can leave a switch fully compromised, giving an adversary a foothold inside the network fabric rather than on an ordinary endpoint.

The exposure matters most to teams that manage Zyxel switch fleets, including school districts and other public-sector networks where switches carry both staff and student traffic. A compromised switch can become a quiet pivot point: it sits in the path of network traffic and can be used to reach other systems, alter routing behavior, or maintain persistence. Because switches are often managed less closely than servers, unusual activity may go unnoticed.

There is also a reporting wrinkle. Some early discussion apparently linked the issue to a flaw that had already been fixed, which can create a false sense of closure. Administrators should treat CVE-2026-107441 as its own item to verify, not assume an earlier patch covers it. The severity is high, and the combination of command execution with a network-core device raises the operational stakes.

What to watch: vendor guidance and updated firmware for affected Zyxel models, anomalous HTTP requests to management interfaces, unexpected configuration changes, new local accounts, and outbound connections from switch management addresses. Until a fix is confirmed, reducing management-plane exposure and increasing logging are the most practical controls.

À faire maintenant

1. Inventory all Zyxel switches and identify management interfaces reachable from untrusted networks; record firmware versions.
2. Apply vendor-provided firmware or mitigations for CVE-2026-107441 as soon as available; do not assume prior patches cover it.
3. Restrict switch administration to a dedicated management VLAN or allowlisted admin hosts; disable WAN-facing management and unnecessary HTTP/HTTPS services.
4. Review HTTP logs and configuration history for crafted requests, unexpected command activity, new accounts, or changed routing and ACL settings.
5. Rotate switch admin credentials and SNMP secrets; enable strong authentication and centralized logging.
6. Segment switch management from user and student networks; monitor for lateral movement originating from switch IP addresses.
7. If compromise is suspected, isolate affected switches, preserve logs, and rebuild configurations from known-good backups.

Références CVE

• CVE-2026-107441

Source originale

SecurityWeek