---
title: "Zyxel GS1900 Switches: Exploited CGI Overflow (KEV)"
url: https://erroneo.us/security/briefs/zyxel-gs1900-cve-2026-7273-cgi-buffer-overflow/
description: "LAN-reachable pre-auth RCE in Zyxel GS1900 switch web UI was used to loot 996 switches. Patch to 2.90(xxxx.2)C0 and wall off management; urgent if exposed."
type: security-brief
section: "Security Digest"
date_published: 2026-06-16
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2026-7273"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Zyxel GS1900 Switches: Exploited CGI Overflow (KEV)

**Verdict: Check exposure.** Patch every GS1900 to the June firmware, but the urgency depends on reach: if the switch's web interface is exposed to the internet, a guest network or a flat LAN, treat it as compromised until checked; if only a locked-down admin VLAN can reach it, patch on a normal cycle this month.

- **Who must act:** Owners of GS1900-8, -8HP, -10HP, -16, -24, -24E, -24EP, -24HPv2, -48 or -48HPv2 switches on 2.90(xxxx.1)C0 or earlier, today if the web interface is reachable from the internet or untrusted networks.
- **Who can relax:** Sites with no GS1900 switches, and sites already on the .2 firmware whose switch management is reachable only from a restricted admin network.
- **Affected:** GS1900-8 2.90(AAHH.1)C0 and earlier; GS1900-8HP 2.90(AAHI.1)C0 and earlier; GS1900-10HP 2.90(AAZI.1)C0 and earlier; GS1900-16 2.90(AAHJ.1)C0 and earlier; GS1900-24 2.90(AAHL.1)C0 and earlier; GS1900-24E 2.90(AAHK.1)C0 and earlier; GS1900-24EP 2.90(ABTO.1)C0 and earlier; GS1900-24HPv2 2.90(ABTP.1)C0 and earlier; GS1900-48 2.90(AAHN.1)C0 and earlier; GS1900-48HPv2 2.90(ABTQ.1)C0 and earlier; EOL GS1900-24HP / GS1900-48HP (v1): status not disclosed, no fix
- **Fixed:** GS1900-8 2.90(AAHH.2)C0; GS1900-8HP 2.90(AAHI.2)C0; GS1900-10HP 2.90(AAZI.2)C0; GS1900-16 2.90(AAHJ.2)C0; GS1900-24 2.90(AAHL.2)C0; GS1900-24E 2.90(AAHK.2)C0; GS1900-24EP 2.90(ABTO.2)C0; GS1900-24HPv2 2.90(ABTP.2)C0; GS1900-48 2.90(AAHN.2)C0; GS1900-48HPv2 2.90(ABTQ.2)C0
- **CVEs:** CVE-2026-7273
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Inventory GS1900 switches and their firmware versions and compare them with Zyxel's table.
2. Upgrade each switch to its 2.90(xxxx.2)C0 build.
3. Remove any internet path to switch management and keep the web interface on a management VLAN behind upstream ACLs; verify from outside with nmap.
4. Change every switch admin password, starting with any still on factory defaults, and rotate SNMP communities, RADIUS/TACACS+ keys and other secrets stored in the config.
5. Replace end-of-life GS1900-24HP and GS1900-48HP (v1) units, which get no fixes.

### How to check if you are affected

- Look for outbound TFTP (UDP 69) from switch management addresses; the exploit pulls a collector script over TFTP.
- Look for bursts of hundreds or thousands of HTTP requests to a switch's web interface (the brute-force mode averages about 2,048 attempts) or unexplained web-service crashes.
- Look for unknown hosts downloading files from a switch's web interface, where the collector stages stolen data.
- Check for traffic to Kapibala campaign infrastructure listed by GreyNoise: 104.225.153.141, 74.48.66.73, 172.245.247.21 and *.981666.xyz.

## What happened

On June 16, 2026, Zyxel published an [advisory](https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-stack-based-buffer-overflow-vulnerability-in-gs1900-series-switches-06-16-2026) and fixed firmware for CVE-2026-7273, a stack-based buffer overflow (CWE-121) in the CGI program of its GS1900 series smart managed switches. A "LAN-based, unauthenticated attacker" can send a crafted HTTP request to the switch's web interface and potentially run OS commands. Zyxel scores it CVSS 3.1 8.8 with an adjacent-network attack vector and credits researchers at ISCAS. The advisory did not mention exploitation.

Three months later, [GreyNoise](https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation) reported that an actor it calls Kapibala used a novel exploit for the bug on or about August 17 and "successfully exploited and exfiltrated sensitive data from 996 ZyXEL switches across 48 countries." GreyNoise describes Kapibala as a suspected Chinese speaker also behind WordPress, Gitea and UniFi OS exploitation. The stolen data included configurations, network details and hashed root-level credentials, and 564 victims still used factory default credentials. The exploit is a PyArmor-obfuscated Python script that targets GS1900-24 firmware 2.10 through 2.90, with options for other models. It has an ASLR brute-force mode that averages about 2,048 attempts. After exploitation, the switch pulls a collector script over TFTP and stages the stolen data in a web-accessible path. CISA added the CVE to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-7273) on September 21 with a three-day deadline.

## Who is affected

Ten models running firmware 2.90(xxxx.1)C0 or earlier: the GS1900-8, -8HP, -10HP, -16, -24, -24E, -24EP, -24HPv2, -48 and -48HPv2. Each has a fixed build ending in .2 C0, for example 2.90(AAHL.2)C0 for the GS1900-24 and 2.90(ABTQ.2)C0 for the GS1900-48HPv2. The full table is in the advisory and on [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-7273). [Help Net Security](https://www.helpnetsecurity.com/2026/09/22/zyxel-switches-cve-2026-7273-vulnerability-exploited/) notes that these switches are common in small offices, schools, hotels and shops.

Zyxel says only that "on-market products not listed in the table remain unaffected." The older GS1900-24HP and GS1900-48HP (v1) are off the market. Zyxel's [archived end-of-life list](https://www.zyxel.com/zyxel-file/eol/ArchivedEOLModel.pdf) shows their vulnerability support ended on January 30, 2021. Whether they are vulnerable is not disclosed as of Oct 21, 2026, and they will not get a fix.

## Do you really need to act?

It depends on who can reach the switch's web interface. The "LAN-based" wording and the adjacent-network score mean the attacker needs HTTP or HTTPS access to switch management. If only a dedicated admin VLAN can reach it, an attacker must already be inside that segment. The risk is real but contained, and patching this month on a normal cycle is reasonable.

The campaign shows that LAN-only does not mean safe. GreyNoise does not say how the 996 switches were reached. In our reading, though, one remote actor hitting devices in 48 countries suggests many had web management reachable from the internet, or from flat networks the actor could get into. If a GS1900 web interface is exposed to the internet, a guest or tenant network, or a flat office LAN, treat it as urgent: patch, change credentials and check for compromise. No botnet use has been publicly reported as of Oct 21, 2026, and the only documented exploitation is the Kapibala campaign. [BleepingComputer](https://bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-actively-exploited-zyxel-flaw-by-thursday) noted that Zyxel had not updated its advisory to confirm exploitation.

## What to do now

1. Inventory GS1900 switches and their firmware versions, which appear in the web interface or your management tool. Compare them with the advisory table.
2. Upgrade each switch to its 2.90(xxxx.2)C0 build from Zyxel's download library.
3. Check exposure from outside your network, for example `nmap -Pn -p 80,443 --open <your-public-ranges>`. Remove any internet path to switch management, and keep the web interface on a management VLAN behind upstream ACLs.
4. Change the admin password on every switch, starting with any still on factory defaults. Rotate SNMP communities, RADIUS/TACACS+ keys and other secrets stored in the config, since configs and password hashes were stolen.
5. Replace end-of-life GS1900-24HP and GS1900-48HP (v1) units.

## How to tell if you were hit

GreyNoise withheld the exploitation IP because of victim sensitivities. Its [campaign timeline](https://www.greynoise.io/chronicle/gntl-20260929-kapibala-exploitation) lists no switch-specific indicators, so hunt mainly by behavior:

- Outbound TFTP (UDP 69) from switch management addresses.
- Bursts of hundreds or thousands of HTTP requests to a switch's web interface, consistent with the brute-force mode, or unexplained web-service crashes.
- Unknown hosts downloading files from a switch's web interface.
- Traffic to the campaign-wide infrastructure GreyNoise lists, which it does not tie specifically to the switch activity: `104.225.153.141`, `74.48.66.73`, `172.245.247.21` and `*.981666.xyz`.

If you find signs of compromise, reflash the fixed firmware, reset the switch to factory defaults, rebuild its config by hand rather than restoring a backup, and rotate every secret it held.

## Timeline

- Jun 16, 2026 — Zyxel publishes the advisory and fixed firmware; the CVE is published.
- Aug 17, 2026 — On or about this date, Kapibala exploits 996 switches and takes their data, per GreyNoise.
- Sep 17, 2026 — GreyNoise identifies this as the first publicly documented in-the-wild exploitation.
- Sep 21, 2026 — GreyNoise publishes its report; CISA adds CVE-2026-7273 to KEV.
- Sep 24, 2026 — CISA's remediation deadline for federal agencies.

## Sources

1. [Zyxel — Security advisory for stack-based buffer overflow vulnerability in GS1900 series switches](https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-stack-based-buffer-overflow-vulnerability-in-gs1900-series-switches-06-16-2026)
2. [CVE record — CVE-2026-7273](https://www.cve.org/CVERecord?id=CVE-2026-7273)
3. [NVD — CVE-2026-7273](https://nvd.nist.gov/vuln/detail/CVE-2026-7273)
4. [CISA — Known Exploited Vulnerabilities: CVE-2026-7273](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-7273)
5. [Zyxel — Archived end-of-life model list (PDF)](https://www.zyxel.com/zyxel-file/eol/ArchivedEOLModel.pdf)
6. [GreyNoise — Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation](https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation)
7. [GreyNoise — Timeline: Kapibala Exploitation](https://www.greynoise.io/chronicle/gntl-20260929-kapibala-exploitation)
8. [Help Net Security — Attacker compromised nearly 1000 Zyxel switches since August (CVE-2026-7273)](https://www.helpnetsecurity.com/2026/09/22/zyxel-switches-cve-2026-7273-vulnerability-exploited/)
9. [BleepingComputer — CISA orders feds to patch Zyxel flaw exploited for data theft](https://bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-actively-exploited-zyxel-flaw-by-thursday)

---
Source page: https://erroneo.us/security/briefs/zyxel-gs1900-cve-2026-7273-cgi-buffer-overflow/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt