CVE-2026-7273
Known exploited · CISA KEV
CVSS 8.8 HIGH: a stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through… EPSS 3% (86th percentile).
CISA federal remediation date Sep 24
Vulnerabilities & Exploits
GreyNoise said a Chinese-speaking threat actor has now exploited Zyxel GS1900 switch flaw CVE-2026-7273 at scale, hitting 996 devices in 48 countries and taking configuration data, networking information, and hashed root credentials. CISA already added the bug to its Known Exploited Vulnerabilities catalog, and Zyxel has fixed it in model-specific firmware.
The flaw is a stack-based buffer overflow in the switch’s CGI web handler. A LAN-based attacker can send a crafted HTTP request to the management interface and trigger command execution without logging in; the theft of hashed root credentials makes the problem linger after the patch if the device was still on factory-default access.
For schools, retail sites, hotels, and SMB networks with GS1900 gear, the exposure is no longer just a vulnerable firmware build. If a compromised switch still sits behind default or weak admin state, patching closes the overflow but does not automatically close the access path the attacker already used.
6 sources · Sep 23
Known exploited · CISA KEV
CVSS 8.8 HIGH: a stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through… EPSS 3% (86th percentile).
CISA federal remediation date Sep 24
BleepingComputer
Chinese hackers exploit WordPress, Zyxel flaws to steal govt data
A Chinese-speaking threat actor has been exploiting vulnerabilities in ZyXEL GS1900 Smart Managed Switches and WordPress to steal sensitive data from 996 devices and more than 18,500 records stored in backend databases.
originalSecurityWeek
Recent ZyXEL Switch Vulnerability Exploited by Chinese Hackers
A Chinese threat actor has exploited the bug to exfiltrate sensitive information from nearly 1,000 ZyXEL switches.
originalHelp Net Security
Attacker compromised nearly 1000 Zyxel switches since August (CVE-2026-7273) - Help Net Security
A threat actor has exploited CVE-2026-7273 in unpatched ZyXEL GS1900 Smart Managed Switches and has exfiltrated sensitive data.
originalPart of the PlainSec briefing for 2026-09-21
Every edition of this story: Zyxel switch exploit kept the door open