Reported by 15 outlets
Zyxel GS1900 switch buffer overflow (CVE-2026-7273) added to CISA KEV
Why this score
- Breadth
- 2.00 / 2.0 · 15 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 4.40 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.40 / 1.5 · reddit signal
- Score
- 0.4 / 10 = base × recency + community
Desk analysis
CVE-2026-7273 is a stack-based buffer overflow (CWE-121) in the CGI program of Zyxel GS1900 series switch firmware, scored 8.8 CVSS v3.1 with low attack complexity, no privileges, and no user interaction. An unauthenticated attacker who can reach the management web server over the LAN sends one crafted HTTP request and gets OS command execution. Zyxel shipped fixed firmware for ten models on June 16, 2026, including 2.90(AAHH.2)C0 for the GS1900-8, 2.90(AAHI.2)C0 for the GS1900-8HP, 2.90(AAZI.2)C0 for the GS1900-10HP, and a build past 2.90(ABTQ.1)C0 for the GS1900-48HPv2. CISA added the bug to KEV on September 21 and gave FCEB agencies until September 24 under BOD 26-04. GreyNoise had already documented real use: on or about August 17, a suspected Chinese-speaking actor exploited 996 GS1900 switches across 48 countries.
The August telemetry is what makes this story matter more than its 8.8 score. The actor's PyArmor-obfuscated script exfiltrated running configs, hashed root credentials, and network information, and 564 of the 996 devices ran factory default credentials, so the operator holds replayable access to hundreds of networks that no firmware update revokes. A switch compromise also buys traffic visibility and lateral pivot options that a single server compromise does not, and the stolen hashes and configs cannot be patched away, only rotated and reset. The LAN-only vector carries its own conclusion the event list never states outright: farming 996 devices across 48 countries means most were internet-exposed or reachable from flat internal networks, which is an exposure finding any GS1900 owner can verify today. Zyxel gear has prior KEV history, so read this as a pattern, not a one-off.
Inventory all GS1900 firmware and upgrade affected models to the June 16 builds; treat anything at or below 2.90 as exposed wherever its management interface reaches beyond a dedicated management VLAN. Reset credentials on any device that ever ran factory defaults, and prefer factory reset plus config rebuild over in-place patching where compromise is plausible, since the collector staged stolen data at /home/web/tmp/info.txt and retrieved it over TFTP. Hunt for outbound TFTP on port 6969, a telnetd listener on port 2323 as the exploit script's own example shows, and HTTP requests to the switch CGI from addresses that never manage it. Check egress and DNS logs for 104.225.153.141, 172.245.247.21, and the *.981666.xyz C2 domain, and match collected files against the actor's backdoor hashes 0e81d80b40eaacbf6cb1e817fb1824c30a824af5cb4faca4aa9b03fd506d480f and 0f6e757e82c4d91df5bd249f775b9970b59dee42cc0dfe40f879d77fc16821c6. The exploit's GOT-overwrite mode lands in a single request, so quiet logs prove nothing.
Two developments would change this assessment. Public release of the deobfuscated exploit, or any working PoC, would drop the bar from one tracked actor to commodity scanning within days; the script already ships offset options for every in-scope firmware, not just the GS1900-24 builds 2.10 through 2.90 it defaults to. Zyxel also still had not updated its advisory to acknowledge exploitation when CISA moved, so a revised vendor advisory, further KEV additions alongside Veeam CVE-2026-32996 in the same batch, or GreyNoise attributing a second actor to the CVE would justify sweeping every GS1900 on the estate.
Timeline
-
original reporting
We added CVE-2026-7273, a stack-based buffer overflow vulnerability affecting Zyxel GS1900 series switches, to the KEV Catalog. Visit https:
go.dhs.gov · 22d ago · September 21st, 2026
We added CVE-2026-7273, a stack-based buffer overflow vulnerability affecting Zyxel GS1900 series switches, to the KEV Catalog. Visit https:
via X https://go.dhs.gov/Z3Q
-
update from zyxel.com
Zyxel security advisory for stack-based buffer overflow vulnerability in GS1900 series switches
zyxel.com · 120d ago · June 16th, 2026
The vendor advisory, dated June 16, 2026 in its own URL and matched by the NVD CVE record published 2026-06-16T03:16Z, describes a stack-based buffer overflow in the CGI program of GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 that a LAN-based unauthenticated attacker could trigger to execute OS commands via a crafted HTTP request. The advisory page now sits behind Zyxel's account login, so the date rests on the vendor URL slug and the NVD record. Fixed firmware for ten GS1900 models shipped the same day.
-
update from greynoise.io
Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation
greynoise.io · 23d ago · September 21st, 2026
GreyNoise's post, timestamped Mon, 21 Sep 2026 in its RSS feed and published before the CVE hit the KEV catalog, is the first public documentation of CVE-2026-7273 exploitation in the wild. On or about August 17, 2026 a suspected Chinese-speaking actor used a PyArmor 6.7.5 obfuscated Python exploit to compromise 996 GS1900 switches across 48 countries, staging a collector over TFTP on port 6969 and exfiltrating configs, hashed root credentials, and network information; 564 victims kept factory default credentials. The script targets GS1900-24 firmware 2.10-2.90 with command-line offsets (libc base, GOT addresses) covering other in-scope firmware.
-
update from secdb.nttzen.cloud
🚨 [CISA-2026:0921] CISA Adds One Known Exploited Vulnerability to Catalog ( https:// secdb.nttzen.cloud/security-ad visory/detail/CISA-2026:
secdb.nttzen.cloud · 22d ago · September 21st, 2026
🚨 [CISA-2026:0921] CISA Adds One Known Exploited Vulnerability to Catalog ( https:// secdb.nttzen.cloud/security-ad visory/detail/CISA-2026:
via Mastodon https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0921
-
update from securityonline.info
CISA warned of an exploited Zyxel switch vulnerability in GS1900 devices. Patch the Zyxel switch vulnerability now to prevent network compro
securityonline.info · 22d ago · September 22nd, 2026
CISA warned of an exploited Zyxel switch vulnerability in GS1900 devices. Patch the Zyxel switch vulnerability now to prevent network compro
via Mastodon https://securityonline.info/exploited-zyxel-switch-vulnerability/?utm_source=mastodon&utm_medium=jetpack_social
-
update from cyberpress.org
CISA Warns of Zyxel GS1900 Switch Flaw to Execute OS Commands Without Authentication
cyberpress.org · 21d ago · September 22nd, 2026
CISA has added a critical security vulnerability affecting Zyxel GS1900 Series switches to its Known Exploited Vulnerabilities catalog, warning that the flaw could enable unauthenticated attackers on a local network to execute operating-system commands through specially crafted HTTP requests. The agency added CVE-2026-7273 on September 21, 2026, and set a remediation deadline of September 24, 2026, for organizations subject to its operational directives. CISA Warns of Zyxel GS1900 Switch Flaw An attacker does not need valid credentials, but must be able to reach the vulnerable device from the local network. The vulnerability has a CVSS v3.1 score of 8.8 out of 10 and is rated High severity. Its CVSS vector identifies a low-complexity attack with no required privileges or user interaction. The flaw is classified as CWE-121, a stack-based buffer overflow weakness. This category of bug occurs when software writes more data into a stack memory buffer than it can safely hold, potentially allowing an attacker to alter program execution flow. A compromised network switch may give attackers a strategically valuable position inside an enterpri
-
update from cyberworldops.eu
Zyxel GS1900 switches (CVE-2026-7273) and Veeam Agent for Microsoft Windows (CVE-2026-32996) are under active exploitation. The former allow
cyberworldops.eu · 21d ago · September 22nd, 2026
Zyxel GS1900 switches (CVE-2026-7273) and Veeam Agent for Microsoft Windows (CVE-2026-32996) are under active exploitation. The former allow
via Mastodon https://cyberworldops.eu/en/active-attacks-put-zyxel-switches-and-veeam-protected-windows
-
update from gbhackers.com
CISA Flags Actively Exploited Flaw in Zyxel GS1900 Switches
gbhackers.com · 21d ago · September 22nd, 2026
CISA added […] The post CISA Flags Actively Exploited Flaw in Zyxel GS1900 Switches appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
mentioned by thehackernews.com
🤖 CISA added Zyxel CVE-2026-7273 (CVSS 8.8) to its KEV catalog: stack-based buffer overflow in GS1900 switches, actively exploited, leading
thehackernews.com · 21d ago · September 22nd, 2026
-
update from bleepingcomputer.com
CISA orders feds to patch Zyxel flaw exploited for data theft
bleepingcomputer.com · 21d ago · September 22nd, 2026
Cybersecurity and Infrastructure Security Agency (CISA). Zyxel released security updates to address this issue on June 16 and advised customers to upgrade their firmware "for optimal protection." While Zyxel has yet to update its advisory to confirm active exploitation of this flaw, CISA added CVE-2026-7273 to its Known Exploited Vulnerabilities (KEV) Catalog on Monday and ordered Federal Civilian Executive Branch (FCEB) agencies to secure their switches against ongoing attacks by Thursday as mandated by Binding Operational Directive (BOD) 26-04. "This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise," the cybersecurity agency said. "While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities." Affected model Affected version Patch availability GS1900-8 2.90(AAHH.1)C0 and earlier 2.90(AAHH.2)C0 GS1900-8HP 2.90(AAHI.1)C0 and earlier 2.90(AAHI.2)C0 GS1900-10HP 2.90(AAZI.1)C0 and earlier 2.90(AAZI.2)C0 GS1900-16 2.90(AAHJ.1)C0 a
-
mentioned by www.bleepingcomputer.com
CISA orders federal agencies to patch actively exploited Zyxel flaw used for data theft
www.bleepingcomputer.com · 21d ago · September 22nd, 2026
-
update from securityweek.com
Recent ZyXEL Switch Vulnerability Exploited by Chinese Hackers
securityweek.com · 21d ago · September 22nd, 2026
A Chinese threat actor has been targeting vulnerable ZyXEL GS1900 switches worldwide for sensitive information exfiltration, threat intelligence firm GreyNoise warns. While the hackers extracted hashed credentials, 564 of the compromised devices had factory default credentials, leaving the door open to future attacks. The same threat actor was also seen using a chain of Ubiquiti vulnerab
-
update from dev.to
What an attacker gains from CVE-2026-7273 on a Zyxel GS1900 switch CVE-2026-7273 lets an... # cybersecurity # infosec # networking # securit
dev.to · 21d ago · September 22nd, 2026
cybersecurity # infosec # networking # securit
via Mastodon https://dev.to/kozhevniko/what-an-attacker-gains-from-cve-2026-7273-on-a-zyxel-gs1900-switch-5col
-
update from nvd.nist.gov
CISA just added CVE-2026-7273 affecting Zyxel GS1900 switches to its KEV catalog.
nvd.nist.gov · 21d ago · September 23rd, 2026
Federal agencies have until Sept. Another reminder that edge switches can quickly become high-value targets once active exploitation starts.
-
update from dev.to
Kapibala: Government Data Theft via WordPress and Active Exploitation of Zyxel CVE-2026-7273 # security # threatintel # software # coding #
dev.to · 21d ago · September 23rd, 2026
Kapibala: Government Data Theft via WordPress and Active Exploitation of Zyxel CVE-2026-7273 # security # threatintel # software # coding #
via Mastodon https://dev.to/anoymask/kapibala-government-data-theft-via-wordpress-and-active-exploitation-of-zyxel-cve-2026-7273-5c58
-
update from beyondmachines.net
Zyxel GS1900 Switches Targeted by Chinese Threat Actor in Data Theft Campaign Zyxel GS1900 series switches are under active exploitation by
beyondmachines.net · 20d ago · September 23rd, 2026
Zyxel GS1900 Switches Targeted by Chinese Threat Actor in Data Theft Campaign Zyxel GS1900 series switches are under active exploitation by
via Mastodon https://beyondmachines.net/event_details/zyxel-gs1900-switches-targeted-by-chinese-threat-actor-in-data-theft-campaign-y-6-z-t-u/gD2P6Ple2L
-
mentioned by www.bleepingcomputer.com
# CISA orders feds to patch # Zyxel flaw exploited for data theft https://www. bleepingcomputer.com/news/secu rity/cisa-orders-feds-to-patch
www.bleepingcomputer.com · 20d ago · September 23rd, 2026