CVE-2026-7273

High

Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability

8.8 CVSS v3.1

Published: Jun 16, 2026
Updated: Oct 25, 2026
Vendor: Zyxel
Affected versions: See affected products
Weakness: CWE-121

Summary

A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.

Severity

High (8.8)

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Zyxel Gs1900-8 Firmware < 2.90(aahh.2)c0
Zyxel Gs1900-8hp Firmware < 2.90(aahi.2)c0
Zyxel Gs1900-10hp Firmware < 2.90(aazi.2)c0
Zyxel Gs1900-16 Firmware < 2.90(aahj.2)c0
Zyxel Gs1900-24 Firmware < 2.90(aahl.2)c0
Zyxel Gs1900-24e Firmware < 2.90(aahk.2)c0
Zyxel Gs1900-24ep Firmware < 2.90(abto.2)c0
Zyxel Gs1900-24hpv2 Firmware < 2.90(abtp.2)c0
Zyxel Gs1900-48 Firmware < 2.90(aahn.2)c0
Zyxel Gs1900-48hpv2 Firmware < 2.90(abtq.2)c0

Exploitation status

Actively exploited

Listed in the CISA Known Exploited Vulnerabilities catalog on Sep 21, 2026. Federal remediation due: Sep 24, 2026.

Technical details

Technical analysis has not been written for this record yet.

Mitigation & remediation

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.