Overview
CISA has added CVE-2026-7273, a stack-based buffer overflow affecting the Zyxel GS1900 series of managed switches, to its Known Exploited Vulnerabilities (KEV) catalog, confirming the flaw is under active exploitation. The bug lives in the switch's web management CGI program: a LAN-based attacker with no credentials can send a crafted HTTP request that overflows a stack buffer and potentially executes arbitrary OS commands on the device.
Zyxel disclosed the vulnerability back in June 2026 and shipped patched firmware for every affected model at that time. The KEV listing three months later confirms attackers are now exploiting devices that were never updated.
Technical Details
| Field | Value |
|---|---|
| CVE ID | CVE-2026-7273 |
| Severity | High (CVSS 3.1: 8.8) |
| CVSS Vector | AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Weakness | CWE-121 (Stack-Based Buffer Overflow) |
| Affected Product | Zyxel GS1900 series managed switches |
| Affected Firmware | Up to and including 2.90(ABTQ.1)C0 |
| Fixed Firmware | 2.90(ABTQ.2)C0 or later (model-specific) |
| Authentication | None required |
| Reported By | Researchers from ISCAS |
| Added to CISA KEV | September 22, 2026 |
How It Works
The overflow sits in the CGI program that backs the switch's web-based management interface. Because the attack vector is rated Adjacent (AV:A) rather than Network, exploitation requires the attacker to already be on the same LAN or VLAN as the switch's management interface — but from there, no login, no prior session, and no user interaction is needed. A single crafted HTTP request to the vulnerable CGI endpoint overflows a stack buffer, and a sufficiently crafted overflow can corrupt the return address and redirect execution, giving the attacker a path to run arbitrary OS commands with the privileges of the CGI process.
The CVSS 8.8 score reflects high impact to confidentiality, integrity, and availability, combined with low attack complexity and no privileges required — the only mitigating factor is the LAN-adjacent access requirement.
Impact Assessment
Who Is At Risk
- Any organization running an unpatched Zyxel GS1900-8, -8HP, -10HP, -16, -24, -24E, -24EP, -24HPv2, -48, or -48HPv2 switch, particularly where the management interface is reachable from a general user VLAN, guest network, or any segment an attacker could reach after an initial foothold
- Small business and branch-office deployments are the GS1900 line's core market, making this a common "set it and forget it" device that's easy to miss in patch cycles
Potential Impact
- Arbitrary OS command execution on the switch itself
- Full compromise of the switch's management plane, enabling traffic interception, VLAN reconfiguration, or use as a pivot point into the rest of the network
- Persistence on core network infrastructure that's rarely monitored as closely as servers or endpoints
Mitigation
- Update firmware immediately to the patched version for your specific model — 2.90(ABTQ.2)C0 for the GS1900-48HPv2, with equivalent version-specific patches for every other model in the affected list per Zyxel's advisory.
- Restrict management interface access using ACLs limited to trusted administrative IP addresses only.
- Isolate switch management traffic onto a dedicated management VLAN, separate from general user or guest traffic — this directly closes off the LAN-adjacent access this flaw depends on.
- Monitor for unusually large or malformed HTTP requests to switch CGI endpoints as a sign of exploitation attempts.
- Federal agencies subject to CISA's Binding Operational Directive should treat this KEV addition as requiring immediate remediation per standard KEV deadlines.