Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack

Executive Summary

In August 2026, a Chinese-speaking threat actor tracked as Red Heron exploited an unauthenticated remote code execution vulnerability in Zyxel GS1900-series managed switches to harvest configuration data, hashed root credentials, and network topology details from 996 devices. The attackers leveraged an out-of-bounds write flaw (CVE-2026-107441) in the switch's web management handler—a flaw that Zyxel's earlier Patch 2 firmware (CVE-2026-7273) failed to fully remediate because the size check was applied after the malicious parameter had already been copied into memory. Commands executed with root privileges. Zyxel released Patch 3 firmware across ten GS1900 models on October 23, 2026, providing the authoritative fix.

This incident exposes a persistent and dangerous pattern: vendor patches that address a symptom while leaving the underlying memory-safety defect exploitable. With CISA's KEV catalog still not listing CVE-2026-107441 as of early November 2026, organizations that believed they were protected by Patch 2 remain silently exposed—underscoring the risk of trusting patch compliance alone without runtime network controls.

Why This Matters Now

Zyxel GS1900 switches running the vendor-recommended Patch 2 firmware remain fully exploitable via CVE-2026-107441 right now. CISA's KEV catalog has not yet listed the new CVE, meaning federal and enterprise teams relying on KEV-driven patch prioritization have no automated signal to act. Red Heron continues active operations, and 564 of the 996 compromised switches still used factory-default credentials—amplifying the blast radius across network infrastructure globally.

Attack Path Analysis

Related CVEs

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

Patch 2 added a check on the parameter counter, but placed it after the oversized parameter had already been copied into memory—meaning the attacker's overwritten counter value was already in place when the check ran, rendering it ineffective. Patch 3 corrects this by validating and limiting the copy before it occurs.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF is directly relevant here because the attackers relied entirely on unrestricted network reachability to the Zyxel switch management interface to trigger unauthenticated code execution at scale. By enforcing identity-aware segmentation and controlled access paths, CNSF would likely have reduced the number of devices reachable from untrusted network zones, constraining both the initial exploitation surface and the downstream blast radius across 996 devices.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: CNSF segmentation would likely constrain which network sources could reach switch management interfaces, reducing the pool of reachable devices an unauthenticated attacker could target at scale across enterprise and government environments.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: While root execution on the switch OS itself cannot be directly prevented by CNSF, Zero Trust segmentation would likely limit what that root-level access could reach outbound — constraining the operational scope of commands run from a compromised device and reducing paths to adjacent infrastructure.

Lateral Movement

Control: East-West Traffic Security

Mitigation: East-west traffic enforcement would likely reduce the attacker's ability to use harvested topology data to move freely between network segments, constraining pivot paths between infrastructure zones even when valid credentials or switch-level access had already been obtained.

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Multicloud visibility and centralized policy control would likely surface anomalous outbound connections from switch network segments to external C2 infrastructure, reducing the window in which data-collection scripts could be fetched and staged data could be retrieved without detection.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Egress security policy enforcement would likely constrain the outbound paths available for staged data retrieval, reducing the attacker's ability to exfiltrate collected credentials and configuration data from switch segments to external staging infrastructure without traversing a controlled exit point.

Impact (Mitigations)

Had prior CNSF controls reduced reachability and segmented east-west paths, the number of switches reachable for exploitation would likely have been smaller — meaning the volume of harvested credentials and topology data, and therefore the scope of residual intelligence available for follow-on operations, would likely have been meaningfully constrained.

Impact at a Glance

Affected Business Functions

  • Network Infrastructure Management and Switching Operations
  • Government and Enterprise LAN Segmentation and Traffic Control
  • Network Device Configuration and Credential Integrity
  • Security Operations and Network Monitoring
Operational Disruption

Estimated downtime: 3 days

Financial Impact

Estimated loss: N/A

Data Exposure

Switch configurations including VLAN, routing, and access control settings were exfiltrated from approximately 996 compromised GS1900 switches. Hashed root credentials were harvested from affected devices, enabling potential credential cracking and persistent re-entry. Network topology and infrastructure information, including connected host details, were collected. Notably, 564 of the 996 affected switches still used factory-default credentials, significantly amplifying the exposure risk. The data was collected via attacker-deployed scripts and staged for exfiltration, suggesting an espionage-oriented operation attributed to the Red Heron threat group with suspected Chinese-speaking ties. No confirmed large-scale financial losses have been reported publicly, but the espionage and credential theft nature of the campaign poses a high residual risk of follow-on intrusions into downstream enterprise and government networks.

Recommended Actions

  • • Apply Zero Trust Segmentation (microsegmentation) to isolate switch management interfaces from general network reachability — network-level policy enforcement ensuring only authorized management hosts can reach device management planes would have prevented unauthenticated exploitation of CVE-2026-107441 regardless of patch status.
  • • Deploy Egress Security & Policy Enforcement controls with FQDN and destination filtering on outbound traffic from network infrastructure segments to block the data-collection script download from the attacker's C2 server and prevent staged exfiltration pickup by unauthorized external destinations.
  • • Enable Encrypted Traffic (HPE) protections including MACsec or IPsec for switch management and inter-device traffic to ensure that harvested configurations, hashed credentials, and network topology data exfiltrated over unencrypted channels cannot be captured or intercepted in transit.
  • • Leverage Multicloud Visibility & Control and Threat Detection & Anomaly Response capabilities to baseline normal management-plane traffic patterns against GS1900 devices and alert on anomalous interactions such as repeated malformed HTTP requests, unexpected script downloads, or bulk data staging activity indicative of exploit automation.
  • • Enforce Cloud Native Security Fabric (CNSF) inline inspection and Inline IPS (Suricata) signature-based detection on traffic destined for network appliance management interfaces to identify and block known out-of-bounds write exploit payloads and malicious data-collection script delivery at the network layer before they reach vulnerable devices.

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsFree Containment AssessmentUnder Active Attack?
Cta pattren Image