Zyxel · GS1900 Series Switches
CVE-2026-7273
Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability
What it is
A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.
CISA: Zyxel GS1900 series switches contain a stack-based buffer overflow vulnerability in the CGI program which could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.
What to do
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Deadline for US federal agencies: September 24, 2026
More exploited flaws from Zyxel
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Feb 11, 2025 | DSL CPE OS Command Injection | DSL CPE Devices | High 8.8 | 21% |
| Feb 11, 2025 | DSL CPE OS Command Injection | DSL CPE Devices | High 8.8 | 23% |
| Dec 3, 2024 | Path Traversal | Multiple Firewalls | High 7.5 | 2.9% |
| Sep 18, 2023 | Command Injection | EMG2926 Routers | High 8.8 | 33% |
| Aug 7, 2023 | Command Injection | P660HN-T1A Routers | Critical 9.8 | 95% |
| Jun 23, 2023 | Multiple NAS Devices Command Injection | Multiple Network-Attached Storage (NAS) Devices | Critical 9.8 | 82% |
| Jun 5, 2023 | Buffer Overflow | Multiple Firewalls | Critical 9.8 | 28% |
| Jun 5, 2023 | Buffer Overflow | Multiple Firewalls | Critical 9.8 | 29% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.