CVE-2026-7273
KEVZyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability
Description
Zyxel GS1900 series switches contain a stack-based buffer overflow vulnerability in the CGI program which could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.
A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.
CVSS 3.1 vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HPublishedJun 16, 2026
Last modifiedOct 25, 2026
Added to KEVSep 21, 2026
Remediation dueSep 24, 2026
References
- zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-stack-based-buffer-overflow-vulnerability-in-gs1900-series-switches-06-16-2026Vendor Advisory
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-7273Third Party AdvisoryUS Government Resource
- greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitationExploitThird Party Advisory
0 recent articles mention this CVE
74
Risk assessment · High
Actively exploited. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 32 days
- CVSS
- 8.8 HIGH
- EPSS (30-day exploit probability)
- 2.8% · top 14% of all CVEs
- Weakness
- CWE-121
- Preconditions
- No privileges and no user interaction
Recommended actions
- 1.Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.