CVE-2026-7273
Known exploited · CISA KEV
CVSS 8.8 HIGH: a stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through… EPSS 3% (86th percentile).
CISA federal remediation date Sep 24
Vulnerabilities · 51 days ago
GreyNoise said a Chinese-speaking threat actor has now exploited Zyxel GS1900 switch flaw CVE-2026-7273 at scale, hitting 996 devices in 48 countries and taking configuration data, networking information, and hashed root credentials. CISA already added the bug to its Known Exploited Vulnerabilities catalog, and Zyxel has fixed it in model-specific firmware.
The flaw is a stack-based buffer overflow in the switch’s CGI web handler. A LAN-based attacker can send a crafted HTTP request to the management interface and trigger command execution without logging in; the theft of hashed root credentials makes the problem linger after the patch if the device was still on factory-default access.
For schools, retail sites, hotels, and SMB networks with GS1900 gear, the exposure is no longer just a vulnerable firmware build. If a compromised switch still sits behind default or weak admin state, patching closes the overflow but does not automatically close the access path the attacker already used.
Known exploited · CISA KEV
CVSS 8.8 HIGH: a stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through… EPSS 3% (86th percentile).
CISA federal remediation date Sep 24
6 sources covering this story
Chinese hackers exploit WordPress, Zyxel flaws to steal govt data
A Chinese-speaking threat actor has been exploiting vulnerabilities in ZyXEL GS1900 Smart Managed Switches and WordPress to steal sensitive data from 996 devices and more than 18,500 records stored in backend databases.
Recent ZyXEL Switch Vulnerability Exploited by Chinese Hackers
A Chinese threat actor has exploited the bug to exfiltrate sensitive information from nearly 1,000 ZyXEL switches.
Attacker compromised nearly 1000 Zyxel switches since August (CVE-2026-7273) - Help Net Security
A threat actor has exploited CVE-2026-7273 in unpatched ZyXEL GS1900 Smart Managed Switches and has exfiltrated sensitive data.
Zyxel and Veeam Flaws Under Active Exploitation With Command and SYSTEM Access
CISA added Zyxel CVE-2026-7273 to KEV after active exploitation, while Arctic Wolf reported attacks on a Veeam Windows flaw.
CISA orders feds to patch Zyxel flaw exploited for data theft
Attackers are now actively exploiting a high-severity vulnerability in Zyxel GS1900 series switches, according to the U.S.
China-nexus actor steals thousands of documents in monthslong exploitation campaign
Researchers suspect the hacker employed LLMs to develop custom tools.
GreyNoise has been tracking malicious use of an IP address since early June 2026 due to its frequent use in scans and attacks against a variety of technologies.
Part of the PlainSec briefing for 2026-09-21