{"id":"CVE-2026-7273","kind":"vulnerability","aliases":["CVE-2026-7273"],"related":[],"title":"A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through…","description":"Zyxel GS1900 series switches contain a stack-based buffer overflow vulnerability in the CGI program which could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"Zyxel GS1900 series managed switches have a stack-based buffer overflow in their CGI web program. A LAN-based attacker with no login can send a crafted HTTP request and potentially run OS commands on the switch.","severity":"high","cvss":8.8,"epss":null,"exploited":true,"exploited_at":"2026-09-21T00:00:00+00:00","products":[{"name":"Zyxel GS1900 Series Switches","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"zyxel gs1900-8 firmware","fixed":["2.90\\(aahh.2\\)c0"],"affected":"< 2.90\\(aahh.2\\)c0","ecosystem":"vendor"},{"name":"zyxel gs1900-8hp firmware","fixed":["2.90\\(aahi.2\\)c0"],"affected":"< 2.90\\(aahi.2\\)c0","ecosystem":"vendor"},{"name":"zyxel gs1900-10hp firmware","fixed":["2.90\\(aazi.2\\)c0"],"affected":"< 2.90\\(aazi.2\\)c0","ecosystem":"vendor"},{"name":"zyxel gs1900-16 firmware","fixed":["2.90\\(aahj.2\\)c0"],"affected":"< 2.90\\(aahj.2\\)c0","ecosystem":"vendor"},{"name":"zyxel gs1900-24 firmware","fixed":["2.90\\(aahl.2\\)c0"],"affected":"< 2.90\\(aahl.2\\)c0","ecosystem":"vendor"},{"name":"zyxel gs1900-24e firmware","fixed":["2.90\\(aahk.2\\)c0"],"affected":"< 2.90\\(aahk.2\\)c0","ecosystem":"vendor"},{"name":"zyxel gs1900-24ep firmware","fixed":["2.90\\(abto.2\\)c0"],"affected":"< 2.90\\(abto.2\\)c0","ecosystem":"vendor"},{"name":"zyxel gs1900-24hpv2 firmware","fixed":["2.90\\(abtp.2\\)c0"],"affected":"< 2.90\\(abtp.2\\)c0","ecosystem":"vendor"},{"name":"zyxel gs1900-48 firmware","fixed":["2.90\\(aahn.2\\)c0"],"affected":"< 2.90\\(aahn.2\\)c0","ecosystem":"vendor"},{"name":"zyxel gs1900-48hpv2 firmware","fixed":["2.90\\(abtq.2\\)c0"],"affected":"< 2.90\\(abtq.2\\)c0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","gs1900","infrastructure","lan","network-switch","zyxel"],"not_affected_if":["no-gs1900-deployed","web-management-not-exposed"],"how_to_check":"Identify GS1900 switches on the network and check their firmware version against the vendor advisory: unknown\nCheck whether the switch web management interface is reachable from untrusted LAN segments: unknown\nCISA lists this CVE as known exploited, so treat any unpatched GS1900 as exposed until verified.","fix":"Apply the vendor firmware update or mitigation per Zyxel's advisory; fixed version: unknown from sources.\nIf no fix is available, follow CISA guidance to discontinue use of the product or isolate its management interface.","status":"open","published_at":"2026-06-16T03:16:13+00:00","first_seen_at":"2026-10-23T19:11:50+00:00","triaged_at":"2026-10-23T20:29:48+00:00","updated_at":"2026-10-23T23:44:52+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T20:29:48Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor firmware update or mitigation per Zyxel's advisory; fixed version: unknown from sources.\nIf no fix is available, follow CISA guidance to discontinue use of the product or isolate its management interface.","summary":"Zyxel GS1900 series managed switches have a stack-based buffer overflow in their CGI web program. A LAN-based attacker with no login can send a crafted HTTP request and potentially run OS commands on the switch.","category":"infrastructure","who_cares":["zyxel","gs1900","network-switch","lan"],"confidence":0.7,"analyst_note":"Find the Zyxel advisory for CVE-2026-7273 to get affected and fixed firmware versions and any workaround, and confirm the CISA KEV due date.","how_to_check":"Identify GS1900 switches on the network and check their firmware version against the vendor advisory: unknown\nCheck whether the switch web management interface is reachable from untrusted LAN segments: unknown\nCISA lists this CVE as known exploited, so treat any unpatched GS1900 as exposed until verified.","needs_analyst":true,"not_affected_if":["no-gs1900-deployed","web-management-not-exposed"],"severity_if_unknown":"high"},"cost_usd":0.000441,"input_tokens":2252,"output_tokens":431,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-04':178C,204C,235C '-16':45A '-2026':20A,23A '-24':49A '-48':68A '-7273':21A,24A '-8':31A '10hp':41A '24e':54A '24ep':59A '24hpv2':64A '26':177C,203C,234C '48hpv2':16A,73A '8hp':36A 'accord':167C 'action':163C 'adher':231C 'allow':140C 'appli':164C 'applic':201C 'asset':225C 'attack':104B,146C 'base':4A,92B,103B,130C,144C,182C 'bod':176C,202C,233C 'buffer':5A,93B,131C 'cgi':10A,97B,136C 'cisa':161C,174C,191C 'cloud':207C 'command':118B,155C 'complianc':172C 'contain':126C 'could':139C 'craft':111B,158C 'cve':19A,22A 'discontinu':210C 'ensur':171C,230C 'evalu':223C 'execut':153C 'exploit':75B,148C 'exposur':228C 'firmwar':17A 'firmware':32A,37A,42A,46A,50A,55A,60A,65A,69A,74A 'flaw':150C 'follow':200C 'forens':193C 'gs1900':15A,26A,30A,35A,40A,44A,48A,53A,58A,63A,67A,72A,76B,84B,123C 'gs1900-10hp':39A 'gs1900-24e':52A 'gs1900-24ep':57A 'gs1900-24hpv2':62A 'gs1900-48hpv2':14A,71A 'gs1900-8hp':34A 'guidanc':189C,205C 'guidelin':237C 'http':112B,159C 'infrastructur':77B 'instruct':170C 'internet':227C 'lan':78B,102B,143C 'lan-bas':101B,142C 'login':107B 'manag':86B 'mitig':165C,216C 'network':80B 'network-switch':79B 'note':188C,199C 'os':117B,154C 'overflow':6A,94B,132C 'patch':236C 'potenti':115B,152C 'priorit':179C 'product':214C 'program':11A,99B,137C 'request':113B,160C 'requir':162C,195C 'respons':221C 'risk':184C 'run':116B 'secur':180C 'see':185C,196C 'send':109B 'seri':85B,124C 'series':27A 'servic':208C 'stack':3A,91B,129C 'stack-bas':2A,90B,128C 'stakehold':219C 'switch':81B,87B,121B,125C 'switches':28A 'triag':194C 'unauthent':145C 'unavail':218C 'updat':181C 'url':186C,197C 'use':211C 'vendor':169C 'version':18A 'via':156C 'vulner':7A,133C 'web':98B 'zyxel':13A,25A,29A,33A,38A,43A,47A,51A,56A,61A,66A,70A,82B,83B,122C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-06-16T03:16:13+00:00","kev":{"dateAdded":"2026-09-21","dueDate":"2026-09-24","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@zyxel.com.tw","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-7273","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-7273","severity":null,"published_at":"2026-09-21T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:50+00:00","fetched_at":"2026-10-25T12:39:21+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-7273","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7273","severity":null,"published_at":"2026-06-16T03:16:13+00:00","modified_at":"2026-09-22T12:10:51+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}