CVE-2026-7273

HIGH

8.8

CVSS Score

Published: June 16, 2026 at 02:20 AM UTC

Updated: October 25, 2026 at 11:10 PM UTC

10 products affected across 1 vendorGS1900-10HP firmwareGS1900-24 firmwareGS1900-8 Firmware· also runs on 10 platforms

Using GS1900-48HPv2 firmware by Zyxel?

Get instant alerts when new vulnerabilities affect GS1900-48HPv2 firmware - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH8.8

Exploitation

CISA KEV

Exploit prediction

EPSS 3%

SSVC

Active

Actively Exploited

CISA Known Exploited Vulnerabilities (KEV) Catalog

EPSS Score2.8%

EPSS (Exploit Prediction Scoring System) estimates a 2.8% chance this CVE is exploited in the wild within the next 30 days — higher than 86% of all CVEs. It complements CVSS: a high EPSS on a mid-severity CVE can still be urgent.

Zyxel GS1900 series switches contain a stack-based buffer overflow vulnerability in the CGI program which could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.

Required Action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Ransomware Use

Unknown

Added to KEV

Sep 21, 2026

Remediation Due

Sep 24, 2026

32 days overdue

Notes

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-stack-based-buffer-overflow-vulnerability-in-gs1900-series-switches-06-16-2026

BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk

Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk

https://nvd.nist.gov/vuln/detail/CVE-2026-7273

Description

A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

GS1900-10HP firmware · Zyxel

95%

All versionsv < 2.90\(aazi.2\)c0

Affected range stops below 2.90(aazi.2)c0, so it looks safe — our inference, not a vendor statement

zyxel-gs1900-10hp (same device)

GS1900-16 firmware · Zyxel

95%

All versionsv < 2.90\(aahj.2\)c0

Affected range stops below 2.90(aahj.2)c0, so it looks safe — our inference, not a vendor statement

zyxel-gs1900-16 (same device)

GS1900-24 firmware · Zyxel

95%

All versionsv < 2.90\(aahl.2\)c0

Affected range stops below 2.90(aahl.2)c0, so it looks safe — our inference, not a vendor statement

zyxel-gs1900-24 (same device)

GS1900-24E firmware · Zyxel

95%

All versionsv < 2.90\(aahk.2\)c0

Affected range stops below 2.90(aahk.2)c0, so it looks safe — our inference, not a vendor statement

zyxel-gs1900-24e (same device)

GS1900-24EP firmware · Zyxel

95%

All versionsv < 2.90\(abto.2\)c0

Affected range stops below 2.90(abto.2)c0, so it looks safe — our inference, not a vendor statement

zyxel-gs1900-24ep (same device)

GS1900-24HPv2 firmware · Zyxel

95%

All versionsv < 2.90\(abtp.2\)c0

Affected range stops below 2.90(abtp.2)c0, so it looks safe — our inference, not a vendor statement

zyxel-gs1900-24hpv2 (same device)

GS1900-48 firmware · Zyxel

95%

All versionsv < 2.90\(aahn.2\)c0

Affected range stops below 2.90(aahn.2)c0, so it looks safe — our inference, not a vendor statement

zyxel-gs1900-48 (same device)

GS1900-48HPv2 firmware · Zyxel

95%

All versionsv < 2.90\(abtq.2\)c0

Affected range stops below 2.90(abtq.2)c0, so it looks safe — our inference, not a vendor statement

zyxel-gs1900-48hpv2 (same device)

GS1900-8 Firmware · Zyxel

95%

All versionsv < 2.90\(aahh.2\)c0

Affected range stops below 2.90(aahh.2)c0, so it looks safe — our inference, not a vendor statement

zyxel-gs1900-8 (same device)

GS1900-8HP firmware · Zyxel

95%

All versionsv < 2.90\(aahi.2\)c0

Affected range stops below 2.90(aahi.2)c0, so it looks safe — our inference, not a vendor statement

zyxel-gs1900-8hp (same device)

Runs on — not affected

The affected product only carries this flaw when running on these platforms. The platforms themselves are not vulnerable.

95%

95%

95%

95%

95%

Gs1900-24Hpv2 · Zyxel

95%

Gs1900-48 · Zyxel

95%

Gs1900-48Hpv2 · Zyxel

95%

Gs1900-8 · Zyxel

95%

Gs1900-8Hp · Zyxel

95%

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-stack-based-buffer-overflow-vulnerability-in-gs1900-series-switches-06-16-2026

References (3)

Vendor Advisory

Source: cverecord

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-stack-based-buffer-overflow-vulnerability-in-gs1900-series-switches-06-16-2026

Third Party AdvisoryUS Government Resource

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-7273

ExploitThird Party Advisory

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation

SSVC — Action Prioritization

SSVCActiveNot automatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

8.8HIGHZyxel

Attack Vector: ADJACENT_NETWORK
Complexity: LOW
Privileges: NONE
User Interaction: NONE
Scope: UNCHANGED
Confidentiality: HIGH
Integrity: HIGH
Availability: HIGH

Vector?

Quick Info

StatusANALYZED

CWE

CWE-121

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card