Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
KEV: Zyxel GS1900 series switches contain a stack-based buffer overflow vulnerability in the CGI program which could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.
NVD: A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.
Hunt for HTTP requests with abnormally long parameters targeting the GS1900 CGI web interface (TCP 80/443), as stack-based buffer overflow exploitation may produce oversized request bodies or crash resets visible in switch access logs.
Research details
ComponentCGI program (web management interface)
PreconditionsAttacker must be on the same LAN segment as the affected GS1900 switch with no authentication required; vulnerable firmware versions through 2.90(*.1)C0 must be running on one of the 10 affected models (GS1900-8, GS1900-8HP, GS1900-10HP, GS1900-16, GS1900-24, GS1900-24E, GS1900-24EP, GS1900-24HPv2, GS1900-48, GS1900-48HPv2); the web management interface must be reachable on TCP 80 or 443. agent
Deliverycrafted HTTP request to web management interface
Exploit notesStack-based buffer overflow in the CGI program triggered by a crafted HTTP request; CVSS attack complexity LOW; no authentication required; LAN adjacency sufficient.
SummaryA stack-based buffer overflow in the CGI program of Zyxel GS1900 series switches allows a LAN-based unauthenticated attacker to execute OS commands via a crafted HTTP request. All 10 GS1900 models are affected at firmware through version 2.90 patch 1 (ABTQ.1)C0. Patched firmware (2.90 patch 2) is available for all affected models.
Tia coverage
First reported2026-09-21
First exploit report2026-09-23
Exploit report → KEV2 days after the listing
When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.