CVE-2026-7273

What is the Zyxel GS1900 Series?

The GS1900 family is Zyxel's line of low-cost "smart managed" Gigabit Ethernet switches, sold in 8, 10, 16, 24 and 48 port variants with and without PoE. They sit a step above unmanaged switches: no CLI-first enterprise operating system, but a web GUI that exposes VLANs, link aggregation, port mirroring, IGMP snooping, 802.1X and SNMP. That combination makes them extremely common in small business wiring closets, branch offices, retail sites, school networks, and as the PoE layer under IP camera and VoIP deployments.

Their value to an attacker comes from position rather than compute power. A switch sees and can redirect traffic for everything plugged into it, port mirroring turns it into a tap, and VLAN reconfiguration collapses the segmentation that the rest of the network's controls depend on. A compromised switch is also a durable foothold: these devices are rarely re-imaged, rarely monitored by EDR, and rarely appear in a vulnerability management inventory at all.

Overview

CVE-2026-7273 is a stack-based buffer overflow in the CGI program that backs the GS1900 web management interface. A request from the local network, with no credentials at all, can carry an oversized field that the CGI handler copies into a fixed-size stack buffer without a length check. The overflow is enough to corrupt the saved return address, and Zyxel's own description states that it can lead to execution of operating system commands on the switch.

Zyxel published the advisory and fixed firmware on 2026-06-16, covering ten GS1900 models. The CVE record carries a CVSS 3.1 base score of 8.8 with the vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The Adjacent attack vector is the one metric holding the score under 9.0: the flaw is reachable from the management LAN rather than from the internet, which matters because the management interface on these switches is normally not internet-facing.

CISA added the CVE to the Known Exploited Vulnerabilities catalog on 2026-09-21, roughly three months after the patch, with a remediation deadline of 2026-09-24. At the time of writing there is no public technical write-up, proof-of-concept, or vendor or researcher blog describing the attacks that drove the KEV listing. CIRCL's Vulnerability-Lookup records the exploitation evidence for this CVE as a vendor report rather than open-source sighting data, which is consistent with the absence of public reporting. EPSS still scores the CVE at 0.00315 (about the 25th percentile), a figure that reflects the lack of public exploit code and should not be read as a statement about the attacks CISA acted on.

Affected Versions

Note that the NVD description names only the GS1900-48HPv2 and its 2.90(ABTQ.1)C0 version string. The vendor advisory is the authoritative list, and it covers all ten models above. Treat any GS1900 running a 2.90 build whose suffix ends in .1)C0 as vulnerable.

Technical Details

The weakness is classified as CWE-121, stack-based buffer overflow. In plain terms: the CGI binary that renders and processes the switch's web pages reads an attacker-controlled value out of an HTTP request and copies it into a buffer that was allocated on the function's stack frame at a fixed size. Because nothing compares the length of the incoming value against the size of the destination, a long enough value writes past the end of the buffer and over whatever the compiler placed after it, including saved registers and the return address. Controlling the return address is what converts memory corruption into code execution, and on an embedded switch running as root with no meaningful exploit mitigations there is no privilege boundary left to cross afterwards.

The attack characteristics are as bad as they get short of internet reachability. No authentication is required, so the attacker does not need the admin password or a valid session; no user interaction is involved; and the CVSS attack complexity is rated Low, meaning no race condition, no memory-layout grooming that depends on target-specific reconnaissance, and no dependence on configuration. The advisory and the CVE record both describe the trigger as a single crafted HTTP request, with no chaining to another CVE required. The limiting factor is reachability: the attacker needs a path to the switch's HTTP management service, which in practice means a position on the management VLAN, a compromised host on a flat network, or a device plugged into an access port on a network where management traffic is not segregated.

Zyxel has not published the vulnerable parameter, the CGI endpoint, or the buffer size, and no third party has reverse-engineered the patch publicly, so the precise entry point remains undisclosed.

Discovery

The vulnerability was reported to Zyxel by Lei Gu, Jun Cao, Zhiqing Rui, Jingzheng Wu and Tianyue Luo of the Institute of Software, Chinese Academy of Sciences (ISCAS). Zyxel credits all five in the advisory. Zyxel acted as the CNA and assigned CVE-2026-7273 itself, publishing the record on the same day as the advisory and the fixed firmware, 2026-06-16, which indicates a coordinated disclosure that ran to completion before any public detail appeared. The ISCAS group has not published a write-up of its own, and no exploit or PoC for this CVE has appeared in public repositories.

Exploitation Context

CISA's KEV addition on 2026-09-21 is the confirmation that this is being exploited. What CISA has not published, and what no vendor or research team has published either, is what the exploitation looks like: there is no named threat actor, no campaign, no reported victim sector, and no indicators of compromise tied to CVE-2026-7273. CISA marks the CVE as not known to be used in ransomware campaigns. Defenders should treat the absence of detail as a gap in public reporting rather than as evidence that the activity is limited.

The Adjacent attack vector shapes the realistic threat model. Because the flaw is not reachable across the internet, there is no meaningful Shodan or Censys exposure count to cite for this CVE, and none has been published. The plausible path is a two-stage one: an attacker who has already landed on the internal network through some other means, phishing, a vulnerable VPN appliance, or a compromised endpoint, uses CVE-2026-7273 to move from a host to the network fabric itself. That progression is a familiar pattern for network-edge and infrastructure devices, and it is also why a switch compromise is worth the effort to an intruder who already has a foothold.

Older GS1900 vulnerabilities give some sense of what follows a successful attack on this platform. Prior flaws in the same product line have been used to obtain administrative sessions and persistent access, and the GS1900's firmware offers no host-based detection of its own. Assume that any compromised switch may hold attacker-modified configuration, an added administrative account, or altered port mirroring, and that firmware-level persistence cannot be ruled out.

Remediation

1. Upgrade to the fixed firmware for your model from the Affected Versions table above. All ten patched builds carry a .2)C0 suffix and are available from Zyxel's download center; the advisory links each model's build directly.
2. If patching must wait, restrict reachability of the web management interface. Move switch management onto a dedicated management VLAN, and use the GS1900's own management VLAN and access-control settings so that only a small set of administrative source addresses can reach the HTTP service.
3. Disable the web GUI on switches that are configured and do not need day-to-day GUI administration. The CGI program is the attack surface here; a switch whose web service is not listening is not exploitable through this path.
4. Verify that the management interface is not exposed beyond the LAN. Confirm no NAT or port-forward rule publishes the switch's HTTP or HTTPS port, and confirm no site-to-site VPN or third-party maintenance tunnel gives an outside party a path to the management VLAN.
5. Review the switch for signs of tampering once patched: unexpected administrative accounts, changed SNMP community strings, port mirroring or SPAN sessions you did not configure, unexplained VLAN membership changes, and configuration save timestamps that do not line up with a change ticket. Export and diff the running configuration against a known-good baseline.
6. Rotate switch credentials and SNMP strings after patching. If the device was exploited before the update, any secret stored on it should be considered known to the attacker.
7. Pull the switch logs to a syslog collector if you are not already doing so, and review what history the device retains for repeated or malformed requests to the CGI endpoints. Local log retention on these devices is small, so anything not already forwarded is likely gone.
8. Federal civilian agencies were required to remediate by 2026-09-24 under BOD 22-01, a three-day window that reflects CISA's assessment of the risk. Everyone else should treat that date as the target rather than as a compliance detail that does not apply to them.