Zyxel GS1900 CVE-2026-7273: Patch Now — 996 Switches Already Breached

If you run Zyxel GS1900 series switches, check your firmware today. CVE-2026-7273 was patched by Zyxel on 16 June 2026, and on 21 September 2026 CISA added it to the Known Exploited Vulnerabilities catalog. This is not theoretical — devices have already been broken into.

What happened

CVE-2026-7273 is a stack-based buffer overflow in the CGI program of the GS1900 series firmware. A crafted HTTP request can let an unauthenticated attacker run OS commands on the switch.
Zyxel published the advisory and the fixed firmware on 16 June 2026. The KEV listing came three months later, on 21 September. That order is the point: the fix has been available for months, and the devices being hit are the ones that never applied it.

What to do today

• ✓Log in to the switch and note the exact model name and current firmware version
• ✓Find your model in the list below and update if you are older than the fixed version
• ✓If your model is not in the list, Zyxel states that on-market products not listed are unaffected. However, models whose vulnerability support period has ended are not listed either, so check Zyxel's support information for your model
• ✓Check whether the web management interface is reachable from anywhere on your LAN. This flaw assumes an attacker already on the same network
• ✓Check whether the administrator password is still the factory default. As shown below, more than half of the compromised devices were

Affected models and fixed firmware

This is the table from Zyxel's own advisory, copied as-is. Match the version string including the bracketed code. The model numbers are easy to confuse — GS1900-24, GS1900-24E and GS1900-24EP are three different products.

• ▸GS1900-8: 2.90(AAHH.1)C0 and earlier are affected → update to 2.90(AAHH.2)C0
• ▸GS1900-8HP: 2.90(AAHI.1)C0 and earlier are affected → update to 2.90(AAHI.2)C0
• ▸GS1900-10HP: 2.90(AAZI.1)C0 and earlier are affected → update to 2.90(AAZI.2)C0
• ▸GS1900-16: 2.90(AAHJ.1)C0 and earlier are affected → update to 2.90(AAHJ.2)C0
• ▸GS1900-24: 2.90(AAHL.1)C0 and earlier are affected → update to 2.90(AAHL.2)C0
• ▸GS1900-24E: 2.90(AAHK.1)C0 and earlier are affected → update to 2.90(AAHK.2)C0
• ▸GS1900-24EP: 2.90(ABTO.1)C0 and earlier are affected → update to 2.90(ABTO.2)C0
• ▸GS1900-24HPv2: 2.90(ABTP.1)C0 and earlier are affected → update to 2.90(ABTP.2)C0
• ▸GS1900-48: 2.90(AAHN.1)C0 and earlier are affected → update to 2.90(AAHN.2)C0
• ▸GS1900-48HPv2: 2.90(ABTQ.1)C0 and earlier are affected → update to 2.90(ABTQ.2)C0

Zyxel says that on-market products not listed in the table remain unaffected. It also says patches were released for models still within their vulnerability support period. In other words, an end-of-life model may be affected and still never receive a fix. If that is your situation, read the section on what to do when you cannot update.

NVD and Zyxel describe different scopes

This trips people up, so it is worth stating plainly. The NVD description names only one model, GS1900-48HPv2. Zyxel's advisory lists ten.
Do not read NVD alone and conclude that your model is unaffected. The vendor's table is authoritative for scope.

Where the score comes from, and what the attacker needs

The score is 8.8 HIGH on CVSS v3.1. Note that this was submitted to NVD by Zyxel as the CNA, not calculated independently by NIST. There is no separate NIST score.
For the record, the NVD public API returns status `Analyzed` with lastModified 2026-09-22T12:10:51 as of 23 September 2026. The NVD web page renders through JavaScript, so what you see depends on how you fetch it — check the API values when the status matters.
The vector is `CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`. The leading `AV:A` means Adjacent Network — the attack is modelled as coming from the same LAN, not straight from the internet.

That does not make it safe. One compromised PC or IoT device on your network is enough of a foothold. A switch sits underneath everything else, so losing it widens the blast radius considerably.

What was actually done to these devices

The intrusion details come from a report by the security firm GreyNoise. The NVD public API lists that report in its references, tagged `Exploit`. It records activity around 17 August 2026 as the first publicly documented exploitation of this flaw in the wild.
The report describes 996 GS1900 switches compromised across 48 countries, with Italy highest at 133 and the United States next at 129. The attacker pulled device configurations, hashed root-level credentials and networking information out to their own infrastructure.

Of those 996 devices, 564 were still using factory default credentials. That is not a precondition for exploiting this vulnerability, but it means two separate problems were stacked on the same hardware. While you are updating firmware, confirm that the administrator password is no longer the shipped default.

If you cannot update

Zyxel's advisory offers no workaround for this vulnerability. The only remedy it gives is the firmware update.
For KEV-listed flaws, CISA's required action is to apply mitigations per vendor instructions, and it states plainly: "discontinue use of the product if mitigations are unavailable." An out-of-support model with no fixed firmware falls squarely into that case. Plan a replacement.
General hygiene such as separating the management network is worth doing regardless, but it is not a Zyxel-sanctioned workaround for this CVE, and it does not evict an attacker who is already inside. Do not treat it as a substitute for the update.

Three lines to forward to a colleague

• ▸If you run Zyxel GS1900 switches, check the firmware today (CVE-2026-7273)
• ▸The fix shipped on 16 June 2026; unpatched devices are actively being broken into
• ▸If the admin password is still the factory default, change it at the same time

Sources