CVE-2026-7273 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-06-16

Added to CISA KEV: 2026-09-21 97 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

⚠️ CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity before patching
PATCH IMMEDIATELY: Apply the latest GS1900-series firmware from Zyxel's security advisory (https://www.zyxel.com/global/en/support/security-advisories/...). This is the primary remediation.
NETWORK SEGMENTATION: Ensure switch management interfaces are isolated in a dedicated, access-controlled management VLAN and are NOT accessible from untrusted network segments or the public internet.
FIREWALL RULES: Verify that no firewall or NAT rules expose TCP port 80/443 of switch management IPs to external/internet addresses. Audit ACLs on upstream routers and firewalls.
DISABLE HTTP: Where possible, disable plain HTTP management access on GS1900 switches and restrict management to HTTPS only. Consider disabling the web GUI entirely if CLI/SNMP management is available and sufficient.
ACCESS CONTROL: Restrict management access by source IP address using built-in switch ACLs or upstream firewall rules to permit only known administrator IP ranges.
MONITORING: Enable logging of management interface access attempts. Monitor for unexpected HTTP requests to switch management IPs, particularly crafted or malformed CGI requests.
SCANNING AWARENESS: Given Greynoise-reported scanning activity, prioritise patching for any GS1900 devices that could potentially be reachable from untrusted network segments.
PATCH PRIORITY: HIGH for any device with management interface exposed beyond a restricted management VLAN; MEDIUM for fully isolated internal deployments with no internet exposure.

🔍 Web Intelligence (Kagi · 2026-09-21)

Summary

CVE-2026-7273 is a high-severity stack-based buffer overflow vulnerability residing in the CGI program of Zyxel GS1900 series switch firmware ^[1]^[2]. This vulnerability is critical because it permits a LAN-based, unauthenticated attacker to inject and execute arbitrary OS commands by sending a specially crafted HTTP request to the affected device ^[1]^[2].

Exploitation

Active Exploitation: There have been reports of scanning activity observed in the wild related to this vulnerability ^[3].
Threat Actors/Campaigns: No specific threat actor groups or ransomware campaigns have been publicly linked to this CVE at this time.
Proof-of-Concept/Exploit Availability: While proof-of-concept information exists describing the nature of the remote code execution, widely available public exploit tools may vary in maturity.
Prerequisites:

- Network Access: Requires access to the local area network (LAN) where the switch is deployed ^[2]. - Authentication: None required; the attack is unauthenticated ^[1]. - User Interaction: Not required.

Affected Products & Patches

Affected Versions: Zyxel GS1900 series switches, including the GS1900-48HPv2, running firmware versions up to and including 2.90(ABTQ.1)C0 ^[2]^[4].
Patch/Hotfix: Zyxel has released security patches to address this vulnerability; users are strongly advised to update to the latest available firmware provided by the manufacturer ^[1].
Mitigations: If an immediate firmware upgrade is not possible, ensure the management interface of the switch is not accessible from untrusted segments of the network or from the public internet.

Impact

Access/Capability: Successful exploitation grants an attacker the ability to execute arbitrary operating system commands on the switch, effectively leading to full system compromise ^[2].
Business Risk: For internet-facing deployments, this vulnerability presents a significant risk as it allows remote attackers to bypass authentication and take control of core networking infrastructure, potentially facilitating lateral movement, traffic interception, or total network disruption.

Sources

Zyxel security advisory for stack-based buffer overflow vulnerability ...
CVE: CVE-2026-7273 Summary Zyxel has released patches for GS1900 series switches affected by a stack-based buffer overflow vulnerability. Users are advised to install them for optimal protection. What is the vulnerability? A stack-based buffer overflow vulnerability in the CGI program of the Zyxel G…
CVE-2026-7273 - Vulnerability Details - OpenCVE
A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90 (ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.
CVE-2026-7273
Active exploitation and scanning activity for CVE-2026-7273 observed by GreyNoise. ... CVE-2026-7273 isn't in our CVE data yet. Newly published CVEs can take time ...
CVE Record: CVE-2026-7273 - Zyxel Corporation
Description. A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 ...

🟢 CVE-2026-7273