Actively exploited Zyxel GS1900 flaw CVE-2026-7273 allows unauthenticated OS commands

The vulnerability is being exploited

CISA added CVE-2026-7273 to its Known Exploited Vulnerabilities catalog on 21 September 2026, turning a Zyxel GS1900 switch flaw from a database entry into a confirmed in-the-wild problem. According to Zyxel's advisory, the bug is a stack-based buffer overflow (CWE-121) in the CGI program behind the switches' web management interface, scored 8.8 under CVSS 3.1 with the vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

In practice, an attacker needs only a network position adjacent to the switch. A crafted HTTP request overflows a stack buffer, and as a dev.to analysis explains, the overwrite can be steered so that execution lands in attacker-controlled data. No authentication and no user interaction are required; the end result is operating-system command execution on the switch itself.

What the attacker gains

Command execution on a switch is less about the box and more about the network it controls. From the device's control plane, an attacker can rewrite VLAN definitions and decide which systems can reach each other, reconfigure ports — including mirroring traffic to a port they watch — and read the running configuration, which frequently holds management credentials reused on other devices. Static routes can be added or forwarding altered so that traffic transits infrastructure the attacker can observe, and the attacker can pivot into every segment the switch bridges or routes without needing credentials for those segments. Where the switch is the only thing separating user, server and management traffic, that separation effectively disappears.

Persistence is also straightforward. A local account can be created, SNMP community strings changed, or the configuration edited so the tampering looks like routine administration. Written to the startup configuration, these changes survive reboots, and switch configurations are rarely reviewed line by line.

Affected models and fixes

Zyxel's advisory lists ten affected models: GS1900-8, GS1900-8HP, GS1900-10HP, GS1900-16, GS1900-24, GS1900-24E, GS1900-24EP, GS1900-24HPv2, GS1900-48 and GS1900-48HPv2. For each model, firmware at the 2.90 series .1)C0 builds and earlier is vulnerable, and the fix is the corresponding .2)C0 release — for example, the GS1900-8 is patched by 2.90(AAHH.2)C0. Zyxel states that on-market products outside this list are unaffected. The NVD record is marked Deferred, so the vendor's table is currently the reference for version ranges.

Public exposure appears modest but is hard to measure. The dev.to analysis reports 5,920 ZoomEye matches for a query fingerprinting Zyxel devices whose page title contains GS1900, though that figure counts fingerprints rather than confirmed vulnerable firmware or reachability. A query scoped to the CVE itself returned no indexed assets — unsurprising, since the exploit depends on adjacent network access rather than internet exposure.

Detection and mitigation

Because post-exploitation changes resemble ordinary administration, detection relies on comparison rather than a single indicator. Keep a known-good configuration backup and diff against it; watch for unexplained accounts, changed SNMP strings, altered VLAN membership and static routes nobody added. Logs from the web interface deserve review for POST requests to CGI endpoints with unusually long parameters, since that is what triggers the overflow.

Until firmware is updated, the practical defence is removing the network path. Move management to a dedicated out-of-band network, disable remote management on reachable interfaces, and block client and guest segments from routing to the switch's web interface. None of this fixes the overflow, but it denies the adjacent position the exploit requires.

Why it matters

Infrastructure devices are often treated as background plumbing, and a KEV listing for a workgroup switch shows why that assumption fails. The switch is the enforcement point for segmentation; compromising it collapses the boundaries it maintains and turns one forgotten device into a pivot across an entire network. With CISA confirming active exploitation and patched firmware available for every affected model, updating the GS1900 fleet and diffing configurations against a baseline should be immediate work rather than a backlog item.