Zyxel GS1900 Switches: Exploited CGI Overflow (KEV)

What to do

1. Inventory GS1900 switches and their firmware versions and compare them with Zyxel's table.
2. Upgrade each switch to its 2.90(xxxx.2)C0 build.
3. Remove any internet path to switch management and keep the web interface on a management VLAN behind upstream ACLs; verify from outside with nmap.
4. Change every switch admin password, starting with any still on factory defaults, and rotate SNMP communities, RADIUS/TACACS+ keys and other secrets stored in the config.
5. Replace end-of-life GS1900-24HP and GS1900-48HP (v1) units, which get no fixes.

How to check if you are affected or compromised

• Look for outbound TFTP (UDP 69) from switch management addresses; the exploit pulls a collector script over TFTP.
• Look for bursts of hundreds or thousands of HTTP requests to a switch's web interface (the brute-force mode averages about 2,048 attempts) or unexplained web-service crashes.
• Look for unknown hosts downloading files from a switch's web interface, where the collector stages stolen data.
• Check for traffic to Kapibala campaign infrastructure listed by GreyNoise: 104.225.153.141, 74.48.66.73, 172.245.247.21 and *.981666.xyz.

What happened#

On June 16, 2026, Zyxel published an advisory and fixed firmware for CVE-2026-7273, a stack-based buffer overflow (CWE-121) in the CGI program of its GS1900 series smart managed switches. A "LAN-based, unauthenticated attacker" can send a crafted HTTP request to the switch's web interface and potentially run OS commands. Zyxel scores it CVSS 3.1 8.8 with an adjacent-network attack vector and credits researchers at ISCAS. The advisory did not mention exploitation.

Three months later, GreyNoise reported that an actor it calls Kapibala used a novel exploit for the bug on or about August 17 and "successfully exploited and exfiltrated sensitive data from 996 ZyXEL switches across 48 countries." GreyNoise describes Kapibala as a suspected Chinese speaker also behind WordPress, Gitea and UniFi OS exploitation. The stolen data included configurations, network details and hashed root-level credentials, and 564 victims still used factory default credentials. The exploit is a PyArmor-obfuscated Python script that targets GS1900-24 firmware 2.10 through 2.90, with options for other models. It has an ASLR brute-force mode that averages about 2,048 attempts. After exploitation, the switch pulls a collector script over TFTP and stages the stolen data in a web-accessible path. CISA added the CVE to the KEV catalog on September 21 with a three-day deadline.

Who is affected#

Ten models running firmware 2.90(xxxx.1)C0 or earlier: the GS1900-8, -8HP, -10HP, -16, -24, -24E, -24EP, -24HPv2, -48 and -48HPv2. Each has a fixed build ending in .2 C0, for example 2.90(AAHL.2)C0 for the GS1900-24 and 2.90(ABTQ.2)C0 for the GS1900-48HPv2. The full table is in the advisory and on NVD. Help Net Security notes that these switches are common in small offices, schools, hotels and shops.

Zyxel says only that "on-market products not listed in the table remain unaffected." The older GS1900-24HP and GS1900-48HP (v1) are off the market. Zyxel's archived end-of-life list shows their vulnerability support ended on January 30, 2021. Whether they are vulnerable is not disclosed as of Oct 21, 2026, and they will not get a fix.

Do you really need to act?#

It depends on who can reach the switch's web interface. The "LAN-based" wording and the adjacent-network score mean the attacker needs HTTP or HTTPS access to switch management. If only a dedicated admin VLAN can reach it, an attacker must already be inside that segment. The risk is real but contained, and patching this month on a normal cycle is reasonable.

The campaign shows that LAN-only does not mean safe. GreyNoise does not say how the 996 switches were reached. In our reading, though, one remote actor hitting devices in 48 countries suggests many had web management reachable from the internet, or from flat networks the actor could get into. If a GS1900 web interface is exposed to the internet, a guest or tenant network, or a flat office LAN, treat it as urgent: patch, change credentials and check for compromise. No botnet use has been publicly reported as of Oct 21, 2026, and the only documented exploitation is the Kapibala campaign. BleepingComputer noted that Zyxel had not updated its advisory to confirm exploitation.

What to do now#

1. Inventory GS1900 switches and their firmware versions, which appear in the web interface or your management tool. Compare them with the advisory table.
2. Upgrade each switch to its 2.90(xxxx.2)C0 build from Zyxel's download library.
3. Check exposure from outside your network, for example nmap -Pn -p 80,443 --open <your-public-ranges>. Remove any internet path to switch management, and keep the web interface on a management VLAN behind upstream ACLs.
4. Change the admin password on every switch, starting with any still on factory defaults. Rotate SNMP communities, RADIUS/TACACS+ keys and other secrets stored in the config, since configs and password hashes were stolen.
5. Replace end-of-life GS1900-24HP and GS1900-48HP (v1) units.

How to tell if you were hit#

GreyNoise withheld the exploitation IP because of victim sensitivities. Its campaign timeline lists no switch-specific indicators, so hunt mainly by behavior:

• Outbound TFTP (UDP 69) from switch management addresses.
• Bursts of hundreds or thousands of HTTP requests to a switch's web interface, consistent with the brute-force mode, or unexplained web-service crashes.
• Unknown hosts downloading files from a switch's web interface.
• Traffic to the campaign-wide infrastructure GreyNoise lists, which it does not tie specifically to the switch activity: 104.225.153.141, 74.48.66.73, 172.245.247.21 and *.981666.xyz.

If you find signs of compromise, reflash the fixed firmware, reset the switch to factory defaults, rebuild its config by hand rather than restoring a backup, and rotate every secret it held.

Timeline#

• Jun 16, 2026 — Zyxel publishes the advisory and fixed firmware; the CVE is published.
• Aug 17, 2026 — On or about this date, Kapibala exploits 996 switches and takes their data, per GreyNoise.
• Sep 17, 2026 — GreyNoise identifies this as the first publicly documented in-the-wild exploitation.
• Sep 21, 2026 — GreyNoise publishes its report; CISA adds CVE-2026-7273 to KEV.
• Sep 24, 2026 — CISA's remediation deadline for federal agencies.

Vulnerability records

• CVE-2026-7273 · KEV 2026-09-21 · A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Zyxel — Security advisory for stack-based buffer overflow vulnerability in GS1900 series switches zyxel.com
2. CVE record — CVE-2026-7273 cve.org
3. NVD — CVE-2026-7273 nvd.nist.gov
4. CISA — Known Exploited Vulnerabilities: CVE-2026-7273 cisa.gov
5. Zyxel — Archived end-of-life model list (PDF) zyxel.com
6. GreyNoise — Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation greynoise.io
7. GreyNoise — Timeline: Kapibala Exploitation greynoise.io

Coverage and analysis

1. Help Net Security — Attacker compromised nearly 1000 Zyxel switches since August (CVE-2026-7273) helpnetsecurity.com
2. BleepingComputer — CISA orders feds to patch Zyxel flaw exploited for data theft bleepingcomputer.com