CyberSecBulletin
CVE-2026-7273Exploited in the wildNVD status: Analyzed

Zyxel GS1900 Series Switches Stack-Based Buffer Overflow

Published Updated By the CyberSecBulletin desk

CVE-2026-7273 is a high-severity stack-based buffer overflow vulnerability in GS1900-48HPv2 firmware from Zyxel, with a CVSS 3.1 base score of 8.8 out of 10. It can be exploited from the same local network by an unauthenticated attacker, without any action from a user. Affected GS1900-48HPv2 firmware versions: <= 2.90(ABTQ.1)C0. The record does not name a fixed version, so check the vendor advisory. CISA added it to the Known Exploited Vulnerabilities catalogue on September 21, 2026, which means attacks have been observed in the wild.

Patch now

Attackers are already exploiting this vulnerability, according to CISA.

What to do

  1. Check which version of GS1900-48HPv2 firmware you run against the affected versions below, and install the vendor's latest release.
  2. CISA's required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
  3. Read the advisory on zyxel.com for workarounds and exact fixed builds.

Affected products and versions

VendorProductAffected versionsFixed in
ZyxelGS1900-48HPv2 firmware<= 2.90(ABTQ.1)C0Not stated
ZyxelGS1900-8 firmware<= 2.90(AAHH.1)C0Not stated
ZyxelGS1900-8HP firmware<= 2.90(AAHI.1)C0Not stated
ZyxelGS1900-10HP firmware<= 2.90(AAZI.1)C0Not stated
ZyxelGS1900-16 firmware<= 2.90(AAHJ.1)C0Not stated
ZyxelGS1900-24 firmware<= 2.90(AAHL.1)C0Not stated
ZyxelGS1900-24E firmware<= 2.90(AAHK.1)C0Not stated
ZyxelGS1900-24EP firmware<= 2.90(ABTO.1)C0Not stated
ZyxelGS1900-24HPv2 firmware<= 2.90(ABTP.1)C0Not stated
ZyxelGS1900-48 firmware<= 2.90(AAHN.1)C0Not stated

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
AdjacentThe attacker must be on the same local network segment.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by CNA (zyxel.com.tw).

Official description

A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Stack-based Buffer Overflow

The product writes past the end of a buffer that was allocated on the stack.

How developers prevent this class of flaw

  • Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking. D3-SFCV (Stack Frame Canary Validation) from D3FEND discusses canary-based detection in detail.
  • Use an abstraction library to abstract away risky APIs. Not a complete solution.
  • Implement and perform bounds checking on input.

More Stack-based Buffer Overflow vulnerabilities (CWE-121)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: active, automatable: no, technical impact: total).
  3. Added to CISA's Known Exploited Vulnerabilities catalogue.
  4. Deadline for US federal agencies to remediate, set by CISA.
  5. Record last changed materially (score, affected products, status or references).

References

Third-party and government advisories

Technical write-ups (may include proof of concept)

Other vulnerabilities in GS1900-48HPv2 firmware

All GS1900-48HPv2 firmware vulnerabilities

Recent Stack-based Buffer Overflow vulnerabilities

Spotted an error? Tell us.