---
title: "CVE-2026-7273: Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability"
url: https://erroneo.us/security/cve/CVE-2026-7273/
description: "CVE-2026-7273 (Zyxel GS1900 Series Switches): Exploited in the wild (CISA KEV). A stack-based buffer overflow vulnerability in the CGI program of Zyxel…"
type: vulnerability-record
section: "Security Digest"
date_published: 2026-06-16
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2026-7273"
kev: true
cvss: 8.8
epss: 0.02501
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2026-7273: Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability

**Signal:** Exploited: patch now if you run it. CISA has confirmed exploitation in the wild. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- Yes, if you run Zyxel GS1900 Series Switches. CISA added this CVE to its Known Exploited Vulnerabilities catalog on 2026-09-21, which means there is reliable evidence of exploitation in the wild. US federal agencies must remediate by 2026-09-24 ; treat that as the outer limit, not the target.
- EPSS 2.5% , percentile 85: FIRST’s model estimates a 2.5% chance of exploitation activity in the next 30 days, higher than 85% of all scored CVEs (elevated). EPSS is a probability, not a verdict.
- Editorial verdict: Check exposure. Zyxel GS1900 Switches: Exploited CGI Overflow (KEV) — Patch every GS1900 to the June firmware, but the urgency depends on reach: if the switch's web interface is exposed to the internet, a guest network or a flat LAN, treat it as compromised until checked; if only a locked-down admin VLAN can reach it, patch on a normal cycle this month.

## What it is

A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.

## Affected products (CVE record)

- Zyxel GS1900-48HPv2 firmware: <= 2.90(ABTQ.1)C0
- Zyxel GS1900-8 firmware: <= 2.90(AAHH.1)C0
- Zyxel GS1900-8HP firmware: <= 2.90(AAHI.1)C0
- Zyxel GS1900-10HP firmware: <= 2.90(AAZI.1)C0
- Zyxel GS1900-16 firmware: <= 2.90(AAHJ.1)C0
- Zyxel GS1900-24 firmware: <= 2.90(AAHL.1)C0
- Zyxel GS1900-24E firmware: <= 2.90(AAHK.1)C0
- Zyxel GS1900-24EP firmware: <= 2.90(ABTO.1)C0
- Zyxel GS1900-24HPv2 firmware: <= 2.90(ABTP.1)C0
- Zyxel GS1900-48 firmware: <= 2.90(AAHN.1)C0

## Severity

- Zyxel CVSS 3.1: 8.8 `CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

## Exploitation

- CISA KEV: added 2026-09-21; federal due date 2026-09-24. Known ransomware use: Unknown.
- CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- CISA SSVC assessment: exploitation active , automatable no , technical impact total .
- FIRST EPSS (model of 2026-10-21): 2.50% probability of exploitation activity in the next 30 days; percentile 85.

## Sources

- [zyxel.com](https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-stack-based-buffer-overflow-vulnerability-in-gs1900-series-switches-06-16-2026)
- [CVE.org record CVE-2026-7273](https://www.cve.org/CVERecord?id=CVE-2026-7273)
- [NVD entry CVE-2026-7273](https://nvd.nist.gov/vuln/detail/CVE-2026-7273)
- [CISA Known Exploited Vulnerabilities catalog entry](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-7273)
- [Listed in CISA KEV notes (cisa.gov)](https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk)
- [Listed in CISA KEV notes (cisa.gov)](https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk)
- [greynoise.io](https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation)

---
Source page: https://erroneo.us/security/cve/CVE-2026-7273/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt