CVE-2026-7273: Zyxel GS1900 Switch CGI Buffer Overflow RCE

CVE-2026-7273 is a stack-based buffer overflow in the CGI program of Zyxel's GS1900 line of smart managed switches that lets a LAN-based attacker, without any credentials, send a crafted HTTP request to the switch's web interface and potentially execute OS commands, and it has already been exploited in the wild to harvest device credentials at scale.

CVE-2026-7273 (CWE-121, stack-based buffer overflow) sits in the CGI program that serves Zyxel GS1900 series switches' web management interface. NVD's description: "A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request" (NVD) — the same flaw, with model-specific firmware builds, affects all ten GS1900 switch models listed above.

The CVSS v3.1 base score, submitted by Zyxel's own CNA ([email protected]) and adopted by NVD, is 8.8 (high), vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — adjacent network access (LAN-based), low attack complexity, no privileges or user interaction required, with high impact to confidentiality, integrity and availability (NVD).

Zyxel's own security advisory, published 2026-06-16, lists the exact vulnerable and fixed firmware build for each of the ten affected GS1900 models and recommends updating to the corresponding .2)C0 build; no workaround beyond patching is given (Zyxel Security Advisory).

CISA added CVE-2026-7273 to the Known Exploited Vulnerabilities catalog on 2026-09-21 with a required-action due date of 2026-09-24, instructing affected organizations to apply vendor mitigations or discontinue use of the product if none are available (CISA KEV). Independent research from GreyNoise documents the exploitation this KEV entry is based on: a threat actor the researchers track as "MCA" used an obfuscated Python exploit script to compromise 996 internet-exposed Zyxel GS1900 switches across 48 countries starting on or about 2026-08-17, exfiltrating device configurations, hashed root credentials and network information via a tftp-fetched collection tool, which GreyNoise describes as the first publicly documented in-the-wild exploitation of this flaw (GreyNoise).

As of 2026-10-26, FIRST scores the probability of exploitation at 0.02778 (86.274th percentile) — moderate relative to the full EPSS population, but notably elevated for a LAN-scoped switch bug, consistent with the documented mass-exploitation campaign (FIRST EPSS).

Because the only effective remediation is the model-specific firmware update, operators running any of the ten GS1900 models listed above should update immediately, restrict management-interface access to trusted LAN segments, and check for the device compromise indicators GreyNoise describes given the documented mass-exploitation campaign.

• LAN-based, unauthenticated attacker can trigger a stack-based buffer overflow in the CGI program of Zyxel GS1900 switches via a crafted HTTP request, potentially executing OS commands. — NVD
• CVSS v3.1 base score is 8.8 (high), vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, submitted by the Zyxel CNA and adopted by NVD. — NVD
• Ten GS1900 models affected, each with a specific vulnerable firmware build fixed in a corresponding .2)C0 release; no other workaround given. — Zyxel Security Advisory
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-09-21, due date 2026-09-24. — CISA KEV
• A threat actor tracked as "MCA" exploited 996 internet-exposed GS1900 switches in 48 countries from on or about 2026-08-17, exfiltrating configurations and hashed root credentials via a tftp-fetched tool. — GreyNoise
• EPSS score is 0.02778 (86.274th percentile) as of 2026-10-26. — FIRST EPSS