CVE-2026-7273

This is a flaw in the switch's built-in management website that can let someone on your local network take over the device. Think of it as a person in your office finding a way to replace the switch's control panel with their own, allowing them to change traffic routes or collect network information.

This matters if you use or run Zyxel GS1900 switches, especially where staff, guests, contractors, or unmanaged devices can join the business network. The affected management service is enabled in the default setup, and the attacker must be connected to the same local network as the switch.

Attackers are already exploiting this vulnerability against Zyxel GS1900 switches. CISA has added it to its catalog of known exploited vulnerabilities, making this a red-priority issue that should be addressed immediately.

Confirm exposure by inventorying all Zyxel GS1900 switches, recording their models and firmware versions, and identifying which networks can reach each switch's HTTP management interface. GS1900-48HPv2 firmware through 2.90(ABTQ.1)C0 is confirmed affected; the findings identify other GS1900 models as affected but provide no model-specific version ranges.

There is no published fixed firmware version or documented upgrade path in the available findings. Obtain vendor guidance before performing firmware upgrades, and retain configuration backups according to your normal change process. If patching is delayed, limit management-interface access to a segregated administrator VLAN or management subnet, block access from user and guest networks, and restrict HTTP management access with network controls.

For organizations subject to CISA BOD 26-04, the remediation due date is 2026-09-24. Review switch logs and configurations for unfamiliar administrator accounts, unexpected configuration exports, altered management settings, unusual HTTP requests, or unauthorized changes to routing, VLAN, and port settings; investigate affected devices for credential and configuration exposure.

CVSS 3.1: 8.8 (High), with adjacent-network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality, integrity, and availability impact. The weakness is CWE-121, a stack-based buffer overflow in the CGI/web-management component, enabling OS command execution through a crafted HTTP request. Exploitation has been observed in the wild since approximately 2026-08-17 and the CVE entered CISA KEV on 2026-09-21; no public exploit code is recorded, but observed exploitation demonstrates weaponized exploit maturity. KEV listing means CISA recognizes active exploitation and requires risk-based remediation for covered federal organizations.