ZeroDayAlert

CVE-2026-7273: Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability

Zyxel GS1900 series switches contain a stack-based buffer overflow vulnerability in the CGI program which could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.

Zyxel GS1900 Series Switches Added to KEV 2026-09-21 Federal due 2026-09-24 Known ransomware use

Required action — quoted from CISA

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Where this comes from. The identifier, product, dates and required action above are copied verbatim from the CISA Known Exploited Vulnerabilities catalog. The action plan below is written by an AI agent from that record and published automatically. AssurePort has not independently tested this vulnerability and makes no claim about whether any specific system is affected.

Who is affected

Zyxel GS1900 series network switches are affected by a stack-based buffer overflow vulnerability in the CGI program. The flaw allows an attacker on the local network to send a specially crafted HTTP request and potentially execute arbitrary OS commands without authentication. The record does not specify which firmware versions are vulnerable or whether newer models in the Zyxel switch portfolio are similarly affected.

How to check whether this touches you

  • Inventory your network devices: determine whether you operate any Zyxel GS1900 series switches and note their count and location (data centre, branch office, management network).
  • Establish network reachability: confirm whether the HTTP management interface on these switches is accessible from untrusted network segments, guest networks, or — if internet-routed — from outside your organisation.
  • Query the running firmware version via the device's web UI or CLI, and cross-reference it against Zyxel's advisory; note that firmware backports can mask the underlying vulnerable code, so version alone is a signal, not final proof.
  • Test HTTP access to the CGI program: attempt a basic connection to the management interface to confirm it is active and responsive.

What to do

  1. Immediately restrict network access to the CGI management interface on affected switches: use firewall rules, VLAN segmentation, or access control lists to permit HTTP/HTTPS only from a dedicated management subnet or jump host.
  2. Check Zyxel's security advisory for patched firmware versions and obtain the update from the vendor.
  3. Plan and schedule patching within the timeframe required by BOD 26-04, prioritising devices exposed to untrusted networks or reachable from the internet.
  4. If patched firmware is unavailable for your model, document the risk and escalate to your security and asset management teams for a decision on continued operation, replacement, or further compensating controls.
  5. Enable and retain HTTP request logs on affected switches and any upstream web application firewalls or proxies for at least 90 days to support incident investigation.

If you find you were exposed

Exploitation of a buffer overflow typically requires precise payload crafting and may leave traces in CGI logs, web server error logs, or system call traces; however, successful exploitation might also corrupt process memory without obvious logs. Examine HTTP access logs on the switch and any network appliances in front of it for requests containing unusual characters, long strings, or patterns typical of buffer overflow fuzzing, looking backwards from the disclosure date. Retain and analyse any core dumps or system logs from the affected period, and check for unexpected process restarts or error messages in the switch's syslog output.

Get these the morning they land.

One email, only when a vulnerability is newly confirmed as exploited — the CISA record plus our action plan. No more than one a day, and nothing on quiet days.

Knowing it exists is not the same as knowing you are exposed.

This page can tell you that CVE-2026-7273 is being exploited. It cannot tell you whether GS1900 Series Switches is running somewhere of yours that is reachable. That question is what a scan answers.

Check your own surface →