CISA ADDS ACTIVELY EXPLOITED ZYXEL GS1900 SWITCH VULNERABILITY TO KEV CATALOG: STACK-BASED BUFFER OVERFLOW CAN ENABLE UNAUTHENTICATED COMMAND EXECUTION

THREAT SUMMARY

Category: Actively Exploited Vulnerability / Network Infrastructure / Managed Ethernet Switches
Affected Product(s): Zyxel GS1900 Series Switches
CVE: CVE-2026-7273
Primary Risks: Stack-based buffer overflow, unauthenticated command execution, switch compromise, network disruption, traffic manipulation, credential exposure, persistence, and follow-on lateral movement
Threat Status: Active exploitation confirmed by CISA
Affected Environment(s): Enterprise networks, small and midsize business infrastructure, branch offices, campus environments, managed Ethernet deployments, surveillance networks, VoIP environments, and other networks using affected Zyxel GS1900 switches
Attack Vector: LAN-based unauthenticated exploitation through a crafted HTTP request targeting the affected CGI program
CVSS: 8.8 High under CVSS 3.1
Weakness: CWE-121 — Stack-Based Buffer Overflow
CISA Action: CVE-2026-7273 added to the Known Exploited Vulnerabilities Catalog on September 21, 2026
Required Response: Federal Civilian Executive Branch agencies must apply applicable BOD 26-04 risk-based remediation requirements. CISA urges all organizations to prioritize remediation of KEV vulnerabilities.

---

CISA has added CVE-2026-7273, a high-severity stack-based buffer overflow affecting Zyxel GS1900 Series managed switches, to its Known Exploited Vulnerabilities Catalog after determining that the flaw is being exploited in real-world attacks.

The September 21 addition moves CVE-2026-7273 beyond ordinary vulnerability management.

This is no longer a theoretical weakness or a flaw waiting for proof-of-concept development.

CISA has confirmed active exploitation.

The vulnerability affects the CGI program used by Zyxel GS1900 switch firmware and can allow a LAN-based attacker who does not possess valid credentials to send a specially crafted HTTP request and potentially execute operating-system commands on the device. Zyxel disclosed the vulnerability in June 2026 and released patched firmware for supported affected models.

The weakness carries a CVSS 3.1 score of 8.8, with an adjacent-network attack vector, low attack complexity, no privileges required, and no user interaction. Successful exploitation can affect confidentiality, integrity, and availability at a high level.

That combination makes the vulnerability especially important for organizations using managed switches inside trusted network segments.

An attacker may not need direct internet access to the switch.

If the attacker already has a foothold on the local network, access through a compromised workstation, rogue device, exposed management VLAN, breached wireless segment, or another internal path may be enough to reach the vulnerable management interface.

---

Vulnerability Details

CVE-2026-7273 — Zyxel GS1900 Stack-Based Buffer Overflow

CVE-2026-7273 affects the CGI program in Zyxel GS1900 Series switch firmware.

A CGI program handles requests submitted through the device’s web management interface.

The flaw allows an attacker located on the same reachable network segment to send a crafted HTTP request that exceeds the bounds of a stack-based memory buffer.

A stack-based buffer overflow occurs when software writes more data into a fixed memory region than the allocated space can safely hold.

When that overwrite reaches adjacent memory, the result can include process crashes, corrupted execution state, modified control flow, or attacker-controlled code execution.

In this case, Zyxel states that exploitation can potentially lead to operating-system command execution without authentication. That is the critical point because the flaw is not limited to crashing the web interface. Successful exploitation may give an attacker a path to execute commands directly on the switch.

A compromised network switch can become far more than a damaged device because it sits directly inside the traffic path. Depending on the configuration and level of access obtained, an attacker could potentially interfere with network operations, alter settings, disrupt connectivity, or use the device as part of a broader intrusion.

Depending on the device configuration and attacker access, control of a managed switch can create opportunities to alter network settings, interfere with availability, observe or redirect traffic, manipulate VLANs, change management settings, establish persistence, or support additional compromise inside the network.

CVE-2026-7273 is associated with CWE-121, Stack-Based Buffer Overflow.

---

Affected Zyxel GS1900 Models

Zyxel identified the following models and vulnerable firmware branches:

• GS1900-8 — 2.90(AAHH.1)C0 and earlier
• GS1900-8HP — 2.90(AAHI.1)C0 and earlier
• GS1900-10HP — 2.90(AAZI.1)C0 and earlier
• GS1900-16 — 2.90(AAHJ.1)C0 and earlier
• GS1900-24 — 2.90(AAHL.1)C0 and earlier
• GS1900-24E — 2.90(AAHK.1)C0 and earlier
• GS1900-24EP — 2.90(ABTO.1)C0 and earlier
• GS1900-24HPv2 — 2.90(ABTP.1)C0 and earlier
• GS1900-48 — 2.90(AAHN.1)C0 and earlier
• GS1900-48HPv2 — 2.90(ABTQ.1)C0 and earlier

Zyxel released corresponding patched firmware ending in 2.90(…2)C0 for supported affected models.

Administrators should verify the exact model and installed firmware rather than relying solely on the GS1900 family name.

Firmware naming differs by model.

A device may appear current based on the major version while still remaining vulnerable because the final build revision has not been updated.

---

Operational Impact

The operational risk extends beyond the switch itself because the affected product sits at the network layer.

Potential consequences can include:

• Unauthorized execution of commands on the switch.
• Modification of network configuration.
• Disruption of switching services.
• VLAN manipulation.
• Loss of management access.
• Network segmentation failure.
• Traffic interception or redirection depending on attacker capability.
• Creation of persistence through altered device settings.
• Use of the switch as a staging point for lateral movement.
• Credential harvesting if management traffic or administrative sessions are exposed.
• Interference with VoIP, surveillance, wireless uplinks, servers, workstations, or other systems dependent on the affected switch.
• Broader business disruption if the device serves as a central access or aggregation point.

The adjacent-network requirement reduces exposure compared with an unauthenticated vulnerability that can be exploited directly from anywhere on the internet.

It does not remove the threat.

Attackers frequently gain local network access through phishing, stolen credentials, exposed remote services, compromised endpoints, malicious insiders, poorly isolated guest networks, breached wireless systems, or another vulnerable device.

Once inside, network infrastructure becomes a high-value target.

A switch can provide access to traffic paths and segmentation controls that ordinary endpoints cannot.

---

Why KEV Status Matters

CISA adds vulnerabilities to the Known Exploited Vulnerabilities Catalog only after specific criteria are met.

Those criteria include:

• A valid CVE identifier.
• Reliable evidence that exploitation has occurred.
• Clear remediation or mitigation guidance.

CVE-2026-7273 now meets that threshold.

KEV inclusion means defenders should no longer treat the vulnerability based only on its CVSS score.

A vulnerability with an 8.8 score and no exploitation evidence can be prioritized differently from one attackers are already using.

CVE-2026-7273 has crossed that line.

Active exploitation makes exposure time critical.

The longer a vulnerable switch remains reachable from compromised or untrusted network segments, the greater the opportunity for attackers to target it.

---

Federal Response

CISA’s September 21 action places CVE-2026-7273 under the federal vulnerability-management framework established by Binding Operational Directive 26-04.

BOD 26-04 requires Federal Civilian Executive Branch agencies to use risk-based vulnerability prioritization rather than treating every CVE equally.

The directive places particular emphasis on KEV-listed vulnerabilities affecting publicly exposed assets that grant attackers total control of the asset after exploitation.

It also establishes expectations for determining whether compromise occurred before remediation.

That compromise-assessment requirement may be important for affected CVE-2026-7273 deployments when the conditions established by BOD 26-04 apply.

Installing patched firmware addresses future exploitation.

It does not establish whether the switch was already compromised.

A network device that was vulnerable during an active exploitation period may require configuration review, log analysis, credential rotation, integrity checks, and further forensic examination before defenders can reasonably consider the incident closed.

---

Defensive Guidance

Organizations using Zyxel GS1900 Series switches should identify affected devices immediately and verify firmware versions.

Priority actions should include:

• Inventory all Zyxel GS1900 switches.
• Record the exact model and firmware build for each device.
• Compare deployed firmware against Zyxel’s patched versions.
• Upgrade affected switches to the vendor-supported fixed firmware.
• Restrict access to switch management interfaces.
• Place management interfaces on dedicated administrative VLANs where possible.
• Prevent ordinary user networks, guest networks, and untrusted devices from reaching switch management services.
• Disable unnecessary HTTP or HTTPS management exposure.
• Use access control lists to limit management access to authorized administrator systems.
• Review switch configuration for unauthorized changes.
• Inspect administrator accounts and local credentials.
• Check for unexpected management users or altered passwords.
• Review VLAN configuration, trunk settings, spanning-tree settings, port configuration, and management addresses.
• Examine system logs for unusual HTTP requests, configuration changes, reboots, service failures, or unexpected administrative activity.
• Rotate administrative credentials if compromise is suspected.
• Review upstream firewall, IDS, IPS, and network telemetry for connections to switch management interfaces from unusual internal hosts.
• Isolate suspicious switches before performing deeper investigation.
• Back up known-good configurations before remediation when operationally safe.
• Validate configuration integrity after firmware installation.
• Confirm the patched firmware is actually running after the device reboots.

Organizations should also determine whether affected switches can be reached from network segments that should never have management access.

A vulnerable device behind a firewall is not adequately protected if compromised internal hosts can still connect directly to the management interface.

---

Compromise Assessment

Because active exploitation is confirmed, defenders should consider whether affected devices may have been targeted before patching.

Indicators worth examining include:

• Unexplained configuration changes.
• Unknown administrator accounts.
• Changed management credentials.
• Unusual switch reboots.
• Unexpected loss of connectivity.
• Altered VLAN assignments.
• Modified trunk or access ports.
• Changes to SNMP configuration.
• New remote-management settings.
• Unexpected HTTP requests directed at the management interface.
• Management connections from ordinary employee endpoints.
• Outbound traffic from the switch that does not match normal behavior.
• Unexplained port mirroring or traffic-monitoring configuration.
• Unexpected DNS, NTP, or gateway changes.
• Logs showing activity during periods when no administrator was working on the device.

If compromise is suspected, patching alone should not be treated as full remediation.

Defenders may need to reset the device to a trusted configuration, rotate credentials, review connected systems, and examine surrounding network activity for signs of lateral movement.

---

30-Day Outlook

The immediate risk surrounding CVE-2026-7273 is likely to remain elevated following its addition to the KEV Catalog.

Organizations should expect:

• Increased scanning for Zyxel GS1900 management interfaces.
• More attempts to identify vulnerable firmware remotely or from compromised internal systems.
• Wider reproduction of exploitation techniques.
• Greater use of the flaw after attackers establish initial access through another vulnerability or stolen credentials.
• Attempts to compromise network infrastructure as part of broader lateral-movement campaigns.
• Increased targeting of small and midsize organizations that may leave managed switches unpatched for long periods.
• More security monitoring focused on abnormal switch administration traffic.
• Expanded vendor and managed-service-provider outreach to customers using affected devices.
• Increased interest in chaining this vulnerability with endpoint compromise or credential theft.
• Greater scrutiny of management VLAN design and internal segmentation.

The vulnerability is particularly valuable inside an established attack chain.

An attacker does not need CVE-2026-7273 to gain initial access.

A compromised workstation, stolen VPN account, exposed remote-management service, phishing intrusion, or breached wireless network could provide the initial foothold.

The Zyxel vulnerability can then become a second-stage target.

That makes internal segmentation and management-plane isolation especially important.

---

TRJ Verdict

CVE-2026-7273 is more than a routine firmware defect affecting a network appliance. It is an actively exploited unauthenticated command-execution path inside managed network infrastructure. The vulnerability affects the CGI program used by Zyxel GS1900 Series switches and can allow a LAN-based attacker to trigger a stack-based buffer overflow through a crafted HTTP request.

Zyxel has released patched firmware, and CISA has now confirmed active exploitation. That combination should move affected devices out of routine maintenance and into priority remediation. Organizations need to identify where vulnerable switches are deployed, determine which systems can reach their management interfaces, install the corrected firmware, and examine affected devices for signs that exploitation may have occurred before remediation.

Network switches often receive less scrutiny than servers and endpoints because they operate quietly in the infrastructure layer, yet that position can make them especially valuable targets. A compromised endpoint may affect one system, while a compromised switch can influence traffic, segmentation, access, and connectivity across an entire network segment.

For organizations operating affected Zyxel GS1900 hardware, the response should be direct: patch the device, restrict the management plane, verify the configuration, review relevant logs and network activity, and determine whether an attacker reached the switch before the fix was applied.

---

---

---

---

---

---

---

---

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

---

---

---

---

---