CVE-2026-7273: Zyxel GS1900 Switches Under Attack

Zyxel patched CVE-2026-7273 on June 16, 2026. By mid-August, a suspected Chinese-speaking threat actor was already using it to break into GS1900 series switches at scale. By the time CISA added the flaw to its Known Exploited Vulnerabilities catalog on September 21, GreyNoise had already tracked 996 compromised devices across 48 countries. Two months between patch and confirmed exploitation is not unusual. What is unusual is how cleanly this one shows the cost of that gap: nearly a thousand switches, more than half of them still sitting on factory-default credentials.

This was never a zero-day. The fix existed for months before anyone needed to worry about active exploitation. That makes it a useful case study in why patch timelines matter even when a CVE does not make headlines on day one.

How It Works

CVE-2026-7273 is a stack-based buffer overflow, CWE-121, in the CGI program of Zyxel GS1900 series switch firmware. An unauthenticated attacker on the local network sends a specially crafted HTTP request to a vulnerable device, and the overflow lets that attacker execute operating system commands on the switch itself. No credentials, no prior access to the management interface, nothing beyond network reach to the device.

According to a GreyNoise report, the actor observed exploiting this in the wild is not stopping at initial access. The exploit is used to retrieve and execute a custom collector script over TFTP. That script, itself obfuscated with the commercial tool PyArmor, pulls configuration data, networking details, and hashed root-level credentials off the device and sends them back to the attacker. The script is hardcoded to target GS1900-24 firmware in the 2.10 through 2.90 range, but it accepts command-line options such as libc base address and global offsets, meaning it was built to be retargeted at other affected models without much additional work.

Who Is Affected

CVSS 8.8, high severity. Ten GS1900 models are in scope, each with its own firmware track: GS1900-8, GS1900-8HP, GS1900-10HP, GS1900-16, GS1900-24, GS1900-24E, GS1900-24EP, GS1900-24HPv2, GS1900-48, and GS1900-48HPv2, all versions 2.90 and earlier on their respective branches. Zyxel has shipped a fixed build for every affected model.

The scale GreyNoise documented gives a sense of how exposed these devices are in practice: 996 compromised switches across 48 countries, with Italy, the United States, Taiwan, France, and South Korea among the most affected. Of those, 564 were still running factory-default settings, meaning the attacker did not need to do anything clever beyond the exploit itself to gain a useful foothold. GS1900 switches are managed network devices, so a compromise here is not just about the switch. An attacker sitting on one can monitor traffic, alter network settings, disrupt connectivity, move laterally into whatever sits behind it, and establish persistence through configuration changes.

Why This One Is Not Just a Patch-and-Move-On CVE

CISA's KEV entry for CVE-2026-7273 comes with a detail worth sitting with: it requires forensic triage under Binding Operational Directive 26-04, not just remediation. Federal agencies running affected switches are expected to conduct a compromise assessment, on top of applying the fix, by September 24. That distinction matters for anyone running these devices, federal or not. Given how long this vulnerability sat exploited before detection, and how many affected devices were caught on default credentials, patching alone does not tell you whether a given switch was already compromised before you got to it.

Worth noting: as of this writing, Zyxel's own advisory has not been revised to acknowledge active exploitation. The confirmation here comes from GreyNoise's independent research and CISA's KEV addition, not from the vendor. That gap between vendor messaging and confirmed real-world exploitation is itself something to watch for on any CVE, not just this one.

Reading It on VulnTracker

CVE-2026-7273's VulnTracker page carries the CVSS 8.8 High badge, the full CPE table across all ten affected GS1900 models plus firmware builds, and the CWE-121 tag. The Newsroom tab is already collecting coverage as it comes in, useful here since the story is still developing: Zyxel's advisory, the initial CISA KEV alert, and the GreyNoise-driven analysis pieces are three separate threads that only come together when you're tracking the CVE directly rather than checking each source separately. Track it to get notified if Zyxel updates its advisory to confirm exploitation, or if CISA revises the remediation deadline.

What to Do

Patch first: every affected GS1900 model has a fixed firmware build available, and the federal deadline of September 24 is a reasonable target for anyone else running these switches. Before you consider the job done, check whether any affected device is still running factory-default admin credentials, since that was the single biggest factor in how easily this campaign spread. If you find one, treat it as potentially compromised rather than assuming the patch alone resolves it: review logs for unauthorized access, unexpected configuration changes, and outbound TFTP traffic, which is how the observed campaign pulled its collector script onto compromised switches. Restrict management interfaces to trusted administrative networks so the device is not reachable from the broader local network in the first place, and if a patch cannot be applied immediately, CISA's guidance is to discontinue use of the affected product rather than leave it exposed.

The Takeaway

CVE-2026-7273 did not need to be a zero-day to compromise nearly a thousand devices. It needed a two-month window and hundreds of switches still sitting on default credentials. That is a more common failure mode than most organizations plan for, and it is exactly the kind of gap that shows up only when you are tracking a CVE's status past the initial patch release.

Track CVE-2026-7273 on VulnTracker to get notified the moment Zyxel updates its advisory, CISA changes the remediation deadline, or new exploitation details surface.

References

Zyxel Security Advisory for Stack-Based Buffer Overflow Vulnerability in GS1900 Series Switches (June 16, 2026); NVD/CVE.org (CVE-2026-7273); CISA Known Exploited Vulnerabilities Catalog addition, September 21, 2026; Help Net Security, "Attacker compromised nearly 1000 Zyxel switches since August (CVE-2026-7273)," citing GreyNoise research.