CVE-2026-7273: Zyxel GS1900 Switch Buffer Overflow Under Active Exploitation

TL;DR

CVE-2026-7273 is a stack-based buffer overflow in the CGI program of Zyxel GS1900 series switches that allows a LAN-based, unauthenticated attacker to execute OS commands via a crafted HTTP request. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-09-21 with a remediation due date of 2026-09-24, so affected organizations have days, not weeks, to act. Patch GS1900-48HPv2 firmware beyond 2.90(ABTQ.1)C0, inventory the rest of the GS1900 family, and restrict management interface access to a dedicated administrative VLAN today.

What is this vulnerability?

Field	Detail
CVE	CVE-2026-7273
Vendor / Product	Zyxel / GS1900 Series Switches
Vulnerability name	Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability
Weakness	CWE-121 (Stack-Based Buffer Overflow)
CISA KEV added	2026-09-21
CISA KEV due date	2026-09-24
Known ransomware use	Unknown
Vendor CVSS 3.1	8.8 HIGH — AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS	~0.0199 (about 80th percentile)

Overview

CVE-2026-7273 is a stack-based buffer overflow (CWE-121) in the CGI program shipped with Zyxel GS1900 series switches. Zyxel's advisory identifies GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 as vulnerable, and the same CGI code path is shared across the GS1900 family, so defenders should inventory every GS1900 model rather than only the explicitly named SKU. The vendor rates the issue as HIGH with a CVSS 3.1 base score of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting that no authentication or user interaction is required once an attacker can reach the device over an adjacent network segment.

CISA added the CVE to the Known Exploited Vulnerabilities catalog on 2026-09-21 with a remediation due date of 2026-09-24. That three-day window is the strongest signal in this advisory: KEV inclusion means CISA has evidence of in-the-wild exploitation, and the compressed deadline is designed to force emergency change rather than a routine patch cycle. For federal agencies, the required action ties remediation to BOD 26-04, Prioritizing Security Updates Based on Risk, and to the associated Forensics Triage Requirements implementation guidance. Stakeholders are responsible for evaluating each asset's exposure and for documenting any device that cannot be remediated within the window.

EPSS currently sits at roughly 0.0199, about the 80th percentile. That is a useful reminder that probabilistic scoring and confirmed exploitation are different signals. A low-to-moderate EPSS score does not downgrade a KEV-listed CVE; it simply reflects that mass scanning has not yet saturated the internet. Anyone operating GS1900 switches in branch offices, retail sites, industrial floors, or lab environments should treat this as an active incident-response item, especially where the management interface is reachable from user VLANs or guest networks.

Technical details

The root cause is a classic stack-based buffer overflow in the switch's CGI handler. The web management component parses HTTP request data into a fixed-size stack buffer without validating the length of attacker-supplied input, so an oversized field overwrites adjacent stack memory, including saved return addresses and control data. Because the overflow occurs in a process that runs with the switch's own privileges, successful corruption can redirect execution and allow OS command execution on the device.

The attack prerequisites are modest. The adversary needs IP reachability to the management interface — the CVSS vector specifies AV:A, adjacent network — and the ability to send a crafted HTTP request. No credentials, no session token, and no user interaction are required, which is why the PR:N/UI:N values matter for triage. The trust boundary that fails here is the boundary between untrusted network input and the privileged CGI process; the CGI program is expected to sanitize request parameters but does not. CWE-121 is the precise classification: a stack buffer whose bounds are not enforced before a copy operation.

Affected version ranges, as reflected in the source intelligence:

• Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 are explicitly named as vulnerable.
• The CGI codebase is shared across the GS1900 family, so other GS1900 models and firmware trains may be affected.
• Confirm the fixed version for each model and hardware revision against the vendor's advisory rather than assuming a single SKU.

Network exposure is the management plane: the web management interface, typically reachable on TCP 80 and 443. The vulnerability is not described as internet-facing in the source material, but access switches are frequently reachable from user, guest, and IoT VLANs, which satisfies the adjacent-network condition in the CVSS vector. That is the exposure path defenders should map first.

Impact

Successful exploitation gives an unauthenticated attacker the ability to execute OS commands on the switch, which converts a network device into a foothold rather than a mere target. Confidentiality, integrity, and availability are all rated HIGH. An attacker can read device configuration, including hashed credentials, SNMP communities, and 802.1X or RADIUS secrets; modify VLAN and ACL configuration to bypass segmentation; and disable or reboot the device to cause an outage.

Downstream abuse is the bigger concern for most defenders. A compromised access switch can be used to mirror traffic, redirect flows to attacker-controlled hosts, disable port security, or establish a persistent pivot into segments that were previously unreachable. In environments where the switch terminates management traffic for cameras, badge readers, or industrial controllers, the blast radius extends well beyond the switch itself. Because the device sits in the data path, an attacker who controls it can observe or manipulate traffic without ever touching an endpoint.

Business exposure includes regulatory notification obligations if configuration secrets or monitored traffic are exfiltrated, plus the operational cost of emergency maintenance windows on devices that are often physically distributed and hard to service. Access switches are also commonly excluded from vulnerability management scope because they are not internet-facing, which means many organizations will discover their exposure only after the KEV deadline has passed.

Exploitability

CVE-2026-7273 is listed in CISA's Known Exploited Vulnerabilities catalog, added 2026-09-21 with a due date of 2026-09-24. KEV inclusion is the authoritative signal that exploitation has been observed in the wild. The source intelligence does not include a public proof-of-concept reference, and known ransomware use is listed as Unknown. EPSS is approximately 0.0199, around the 80th percentile.

The absence of a public exploit does not reduce urgency here. The vulnerability is unauthenticated, requires no user interaction, and is reachable from any host that can route to the management interface — a low bar in flat or lightly segmented networks. The tight KEV deadline reflects that reality. Defenders should assume that exploitation attempts will target the CGI endpoint directly and that scanning activity may be visible in web logs before any successful compromise.

KEV vs CVSS vs EPSS

Signal	What it measures	Action for this CVE
CISA KEV	Confirmed in-the-wild exploitation	Treat as active incident; remediate by 2026-09-24 per BOD 26-04
CVSS 3.1 (vendor)	8.8 HIGH — technical severity of the flaw	Confirms unauthenticated, adjacent-network, high CIA impact; drives triage priority
EPSS	~0.0199, about 80th percentile — probability of exploitation activity	Informational only; does not downgrade KEV status

Exploitation steps (defensive triage)

1. Inventory all GS1900 series switches and determine which firmware versions are at or below 2.90(ABTQ.1)C0, prioritizing devices whose management interface is reachable from user, guest, or IoT VLANs.
2. Confirm network reachability from an untrusted segment to TCP management ports (typically 80/443) using your own authorized scanning, and record which ACLs or firewall rules currently permit that path.
3. Review web server and CGI access logs on the switch for unusually long request URIs, query strings, or POST bodies, and for requests to CGI endpoints that are not part of normal administrative workflows.
4. Correlate any suspicious HTTP requests with subsequent process activity, unexpected outbound connections, or configuration changes on the device.
5. Check for evidence of post-exploitation behavior such as new local accounts, modified startup configuration, altered SNMP settings, or unexpected TFTP/SCP transfers.
6. If compromise is suspected, isolate the switch from untrusted segments, capture volatile state (running config, logs, ARP/MAC tables), and preserve it before rebooting.
7. Apply the vendor's fixed firmware per the advisory, then re-verify that management access is restricted to a dedicated out-of-band or admin VLAN.
8. Document the timeline and scope, and evaluate whether adjacent devices on the same segment require credential rotation or configuration review.

Indicators of compromise

• HTTP requests to CGI endpoints with abnormally long parameters, repeated filler bytes, or non-printable characters in the URI or body.
• Switch web logs showing 200 responses to malformed or oversized requests, or bursts of requests from a single non-administrative host.
• Unexpected outbound connections from the switch management IP to internal hosts or external addresses on unusual ports.
• New or modified local user accounts, changed admin passwords, or altered SNMP community strings and trap destinations.
• Configuration diffs showing new VLANs, ACL changes, port mirroring (SPAN) sessions, or disabled port security.
• Unexpected reboots, watchdog resets, or CGI process crashes recorded in device syslog.
• EDR or NetFlow anomalies on hosts in the same segment as the switch, such as scanning or lateral movement shortly after suspicious switch activity.
• Firmware or configuration file transfers via TFTP, SCP, or HTTP to hosts that are not part of your management infrastructure.

Mitigation and workarounds

Apply the fixed firmware release identified in Zyxel's security advisory for the GS1900 series as the primary remediation. Verify the exact fixed version for each model and hardware revision before upgrading, and stage the upgrade during a maintenance window that accounts for the switch's role in the data path.

Until patching is complete, restrict management interface access to a dedicated administrative VLAN or out-of-band management network, and block TCP 80/443 to switch management addresses from user, guest, and IoT segments at the firewall and on the switch itself. Disable the web management interface entirely where it is not operationally required, and prefer SSH or console access for administration. Enforce strong administrative credentials, rotate any secrets that may have been exposed, and review SNMP configuration for unauthorized changes.

Because CISA's KEV entry carries a 2026-09-24 due date, align remediation with BOD 26-04 risk-based prioritization and document any device that cannot be patched in time, along with the compensating controls applied. If mitigations cannot be implemented, consider discontinuing use of the affected device on untrusted segments until it can be replaced or isolated. After patching, re-scan the management interface to confirm the fixed version is running and that no unauthorized configuration changes persist.

Community reactions

Coverage of CVE-2026-7273 has centered on the KEV listing and the unusually tight remediation window, which pushed the issue from routine patch backlog into emergency change territory for many network teams. Security media and vendor advisories emphasized the unauthenticated, adjacent-network nature of the flaw, noting that access switches are frequently overlooked in vulnerability management programs because they are not internet-facing. Practitioners on social channels highlighted the shared-codebase concern across the GS1900 family and the difficulty of patching large fleets of distributed switches during business hours. The absence of a public proof-of-concept in the source intelligence does not reduce urgency, given confirmed exploitation reflected by KEV inclusion. Discussion has also focused on the need for better out-of-band management segmentation as a durable control, not just a temporary workaround.

FAQ

Is CVE-2026-7273 in the CISA KEV catalog? Yes. CISA added it on 2026-09-21, which indicates confirmed in-the-wild exploitation.

What is the KEV remediation due date? 2026-09-24. Federal agencies must remediate by that date under BOD 26-04; other organizations should treat it as an emergency change deadline.

Is the vulnerability internet-facing? The source material describes a LAN-based, adjacent-network attack (CVSS AV:A). The management interface is typically not internet-facing, but it is often reachable from user, guest, or IoT VLANs, which is sufficient exposure.

Which products are affected? Zyxel GS1900 series switches. GS1900-48HPv2 firmware through 2.90(ABTQ.1)C0 is explicitly named, and the shared CGI codebase means other GS1900 models should be verified against the vendor advisory.

Does exploitation require credentials? No. The CVSS vector shows PR:N and UI:N — no authentication and no user interaction are required once the attacker can reach the management interface.

How do I verify remediation? Confirm the fixed firmware version is running on each device, re-scan the management interface for reachability from untrusted segments, and review configuration for unauthorized changes.

What if I cannot patch before the deadline? Restrict management access to a dedicated admin VLAN or out-of-band network, disable web management where possible, and document the compensating controls per BOD 26-04 guidance.

Related resources

• Zyxel Security Advisory for Stack-Based Buffer Overflow Vulnerability in GS1900 Series Switches
• NVD entry for CVE-2026-7273
• CISA BOD 26-04, Prioritizing Security Updates Based on Risk
• CISA BOD 26-04 Implementation Guidance, Forensics Triage Requirements