This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Actively exploited vulnerability in Zyxel switches
CISA warns of a now actively exploited [1], high-severity vulnerability from 16 June 2026 in the firmware of Zyxel GS1900 series switches [2]. Affected models and their fixed versions: GS1900-8 – 2.90(AAHH.2)C0 GS1900-8HP – 2.90(AAHI.2)C0 GS1900-10HP – 2.90(AAZI.2)C0 GS1900-16 – 2.90(AAHJ.2)C0 GS1900-24 – 2.90(AAHL.2)C0 GS1900-24E – 2.90(AAHK.2)C0 GS1900-24EP – 2.90(ABTO.2)C0 GS1900-24HPv2 – 2.90(ABTP.2)C0 GS1900-48 – 2.90(AAHN.2)C0 GS1900-48HPv2 – 2.90(ABTQ.2)C0
An unauthenticated attacker on an adjacent network can, due to a stack buffer overflow in a CGI program, potentially execute operating system commands using a specially crafted HTTP request [2]. In addition to an immediate update to the fixed version, it is advisable to change the login credentials and other sensitive data stored in the configuration of potentially affected devices, since according to GreyNoise [3] the attacker exfiltrated the configuration and password hashes. More detailed information about the vulnerability and the entire campaign, including IoCs, can be found at [3].
CVSS: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2026-7273 at cve.org, NVD
- CWE-121: Stack-based Buffer Overflow at cwe.mitre.org
The vulnerability was publicly disclosed 16. 6. 2026. This report was last updated 22. 9. 2026.
Links
- [1] https://www.cisa.gov/news-events/alerts/2026/09/21/cisa-adds-one-known-exploited-vulnerability-catalog
- [2] https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-stack-based-buffer-overflow-vulnerability-in-gs1900-series-switches-06-16-2026
- [3] https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation
By CESNET, z.s.p.o. Michaela Ručková on 22. 9. 2026.