CVE-2026-7273 · A stack-based buffer overflow vulnerability in the CGI program of Z…

01 · The Real Story

Like leaving the supply closet unlocked — anyone on the same floor can rewire the building's electricity

CVE-2026-7273 is a stack-based buffer overflow (CWE-121) in the CGI handler of Zyxel's GS1900 series smart managed switches. An unauthenticated attacker on the same Layer 2 segment can send a single crafted HTTP request to the switch management interface, overflow a fixed-size stack buffer in the CGI process, and achieve arbitrary OS command execution — full device takeover with no credentials required. All ten models in the GS1900 family are affected through firmware 2.90(xxxx.1)C0: the GS1900-8, -8HP, -10HP, -16, -24, -24E, -24EP, -24HPv2, -48, and -48HPv2. Zyxel shipped model-specific patches at 2.90(xxxx.2)C0 on June 16, 2026.

The vendor's CVSS 8.8 HIGH is well-calibrated — the AV:A vector correctly encodes the adjacent-network requirement, and the pre-auth, no-interaction, full-CIA-impact scoring is accurate. However, your intel is stale: CISA added CVE-2026-7273 to the KEV catalog on September 21, 2026 — yesterday — confirming active exploitation in the wild. This transforms the threat picture. The GS1900 is an SMB-tier access-layer switch, not core datacenter gear, so noisgate downgrades the effective score to 7.5 — the product's limited enterprise blast radius and the post-compromise prerequisite (attacker must already be on the LAN) justify a modest reduction. But the KEV listing and network-device target class anchor this firmly at HIGH. Treat this as a "patch now" situation, not a "next maintenance window" one.

"KEV-listed yesterday. Pre-auth RCE on your branch switches demands immediate LAN-side patching."

02 · The Attack Path

5 steps from start to impact.

STEP 01

Establish adjacent network position

The attacker must gain Layer 2 connectivity to the same VLAN or broadcast domain as the GS1900 management interface. This typically means they have already compromised a workstation, printer, IP phone, or IoT device on the target segment — or have physical access to a wall jack. In poorly segmented networks, the management interface may be reachable from user VLANs.

Conditions required:

Prior compromise of a host on the same LAN/VLAN as the switch management interface
OR physical access to a network port on the same segment

Where this breaks in practice:

Requires an initial-access step — this is a post-compromise technique, not internet-facing
Well-segmented networks place switch management on a dedicated out-of-band VLAN unreachable from user segments
802.1X port authentication limits rogue device attachment

Detection/coverage: EDR on the compromised pivot host should detect lateral scanning; network IDS may flag ARP or port-scan activity toward infrastructure IPs

STEP 02

Fingerprint the GS1900 management interface

The attacker scans the local segment for HTTP services on the switch management IP (default port 80). The GS1900 login page presents Zyxel branding and model identification, making fingerprinting trivial. SNMP queries to sysDescr (OID 1.3.6.1.2.1.1.1.0) also reveal the exact model and firmware version string.

Conditions required:

Network connectivity to the switch management IP on HTTP (TCP/80) or SNMP (UDP/161)

Where this breaks in practice:

Management ACLs may restrict source IPs that can reach the HTTP interface
SNMP community strings may be changed from default public

Detection/coverage: Port scans from non-admin workstations toward infrastructure management IPs should trigger anomaly alerts in NDR/SIEM

STEP 03

Send crafted HTTP request to vulnerable CGI endpoint

The attacker sends a single malicious HTTP request to the CGI program with an oversized input parameter. The CGI handler copies user input into a fixed-size stack buffer without length validation, overflowing into adjacent stack memory including the saved return address. No authentication cookies, tokens, or credentials are required — the overflow occurs during pre-auth request parsing. No public PoC exists; exploitation requires custom tooling.

Conditions required:

Vulnerable firmware ≤ 2.90(xxxx.1)C0
HTTP management interface reachable from attacker position

Where this breaks in practice:

No public PoC on GitHub, ExploitDB, or Metasploit as of 2026-09-22 — attacker needs privately developed exploit
Stack protections on the embedded ARM/MIPS platform (if any) may complicate reliable exploitation
ASLR/NX status on ZynOS embedded platform is uncertain but likely weak

Detection/coverage: No Nuclei template, Snort signature, or vendor-specific IPS rule exists for this CVE; generic HTTP buffer-overflow heuristics in WAF/IPS may catch oversized parameters but are unreliable

STEP 04

Achieve OS command execution on the switch

Successful stack corruption redirects execution to attacker-controlled code — either injected shellcode or a ROP chain. The attacker gains arbitrary command execution with the privilege level of the CGI web service on the embedded Linux platform. Commands execute in the context of the switch OS, giving full control over switching fabric, VLAN configuration, port mirroring, and routing tables.

Conditions required:

Successful buffer overflow exploitation bypassing any platform mitigations

Where this breaks in practice:

Embedded switch OS has minimal tooling — no Python, limited shell, constrained storage
Switch reboots or firmware updates clear non-persistent implants

Detection/coverage: No EDR runs on embedded switch firmware; configuration integrity monitoring (RANCID, Oxidized) may detect post-exploitation changes to running config

STEP 05

Weaponize switch position for lateral movement

With OS-level control of the switch, the attacker can mirror any port to intercept traffic in transit (credential harvesting, sensitive data exfiltration), reconfigure VLANs to collapse network segmentation boundaries, inject ARP replies to redirect traffic for MitM, or use the switch as a stealthy pivot point completely invisible to endpoint detection. The switch becomes a persistence anchor that survives host reimaging on connected workstations.

Conditions required:

Persistent or repeated access to the switch OS

Where this breaks in practice:

TLS/SSH-encrypted traffic limits the value of passive interception
Spanning-tree topology changes generate syslog alerts in properly monitored networks
Configuration management diffs (RANCID/Oxidized) will flag unauthorized VLAN or port-mirror changes

Detection/coverage: Network configuration management tools flag config drift; NetFlow/sFlow anomaly detection may identify unexpected traffic mirroring; 802.1Q trunk changes generate SNMP traps

03 · Intelligence Metadata

The supporting signals.

In-the-Wild Status	Active exploitation confirmed. CISA added CVE-2026-7273 to the KEV catalog on 2026-09-21. No specific campaign attribution published yet, but KEV inclusion requires documented evidence of exploitation.
PoC Availability	No public PoC found on GitHub, ExploitDB, or Metasploit as of 2026-09-22. Active exploitation implies private tooling exists in adversary hands.
EPSS Score	0.00315 (~31st percentile) — low model-predicted probability, contradicted by confirmed KEV listing. EPSS lags behind real-world exploitation for niche embedded devices.
KEV Status	Added 2026-09-21 — the day before this assessment. Federal remediation deadline: 2026-09-24 (3 days). User-supplied intel ('KEV listed: No') was stale.
CVSS Vector	`CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` — Adjacent-only (not internet-routable), low complexity, no auth, no interaction, full CIA impact. The `AV:A` is the critical limiter separating this from a 9.8.
Affected Versions	10 models: GS1900-8, -8HP, -10HP, -16, -24, -24E, -24EP, -24HPv2, -48, -48HPv2. All firmware through `2.90(xxxx.1)C0` per model-specific build strings.
Fixed Versions	Per-model `2.90(xxxx.2)C0` firmware — e.g., GS1900-48HPv2 → `2.90(ABTQ.2)C0`, GS1900-24 → `2.90(AAHL.2)C0`, GS1900-8 → `2.90(AAHH.2)C0`. Available from Zyxel advisories page.
Exposure Data	~3,500 devices with HTTP management exposed per Shodan; ~1,250 per Censys. These are misconfigurations — `AV:A` means the vendor never intended internet-facing management. Check your ASM platform for any external exposure.
Disclosure Date	2026-06-16 — Zyxel advisory and NVD publication simultaneous. Patch has been available for 98 days.
Credited Researchers	Lei Gu, Jun Cao, Zhiqing Rui, Jingzheng Wu, and Tianyue Luo — Institute of Software, Chinese Academy of Sciences (ISCAS).

04 · The Call

Final Verdict

= UNCHANGED to HIGH (7.5/10)

Why this verdict

Adjacent-only vector implies post-compromise position (−0.5): AV:A means the attacker must already hold a foothold on the target LAN segment. This is not a drive-by internet RCE — it requires a prior initial-access step. Every exploitation scenario starts with 'assume the attacker is already inside,' which means the switch vuln is a *privilege escalation to network infrastructure*, not an entry point.
SMB-tier product limits enterprise blast radius (−0.5): The GS1900 is Zyxel's entry-level smart managed switch, priced at $150–$500, marketed to small offices and branch locations. In a 10,000-host enterprise, these typically serve non-critical access-layer roles in satellite offices — not datacenter cores, not identity tiers, not perimeter. The installed base in large enterprises is small relative to Cisco Catalyst or Aruba equivalents.
No public PoC constrains attacker population (−0.3): Despite KEV listing, no exploit code is publicly available. Exploitation requires private development of a stack-overflow exploit for an embedded ARM/MIPS platform — a skill bar that limits this to motivated, resourced adversaries rather than script-level operators.
Role multiplier: *(a) Typical role:* branch-office access switch serving 8–48 endpoints. Compromise gives segment-level traffic interception and VLAN manipulation — *host-to-segment* blast radius. *(b) High-value role:* sole switch in a retail/POS site carrying payment traffic, or a small site whose switch bridges the VPN uplink to corporate. Compromise could expose cardholder data or provide a pivot into the corporate WAN — *segment-to-tenant* blast radius. This high-value role is plausible but represents <5% of the GS1900 installed base. The device is NOT a canonical high-value component (not a perimeter appliance, DC, IdP, hypervisor, or CA). The HIGH floor holds because network-device compromise enables stealthy lateral movement invisible to endpoint detection, and active exploitation is confirmed.
KEV + active exploitation anchors the floor: CISA's KEV addition on 2026-09-21 confirms real-world weaponization. Despite low EPSS, the exploitation signal is authoritative. This prevents any downgrade below HIGH and overrides the mitigation SLA to 'immediately, within hours.'

Why not higher?

CRITICAL requires either an internet-facing attack vector or a canonical high-value target component. The GS1900 is an SMB access-layer switch — not a perimeter appliance (F5, FortiGate, PAN-OS), identity system (AD, Okta), hypervisor (ESXi, vCenter), or CI/CD platform. The AV:A constraint means exploitation requires a prior network compromise — the switch is a second-stage target, not an entry point. Even the ~3,500 Shodan-exposed instances are misconfigurations of a device designed for internal use, not evidence of a canonical perimeter role.

Why not lower?

Active exploitation is confirmed by CISA KEV (added 2026-09-21, federal deadline 2026-09-24). Pre-auth RCE on any network infrastructure device — even an access-layer switch — is categorically dangerous because it gives the attacker a position *below* endpoint detection: port mirroring, VLAN reconfiguration, ARP spoofing, and persistent network-level pivot. Compromise of a switch affects every host connected to it, and the implant survives workstation reimaging. A MEDIUM rating would understate the network-layer blast radius and contradict the KEV signal.

05 · Compensating Control

What to do — in priority order.

Isolate switch management onto a dedicated out-of-band VLAN — Move all GS1900 management interfaces to a management VLAN unreachable from user/production segments. This eliminates the adjacent-network prerequisite for the vast majority of attacker positions. Deploy within hours — active exploitation (KEV) overrides the standard noisgate mitigation SLA. If you cannot VLAN-isolate immediately, apply host-based firewall rules on the management interface to restrict source IPs.
Apply firmware update to 2.90(xxxx.2)C0 for each model — This is the definitive fix. Download model-specific patched firmware from Zyxel's advisory page and flash during an emergency maintenance window. Patch immediately, within hours — KEV active exploitation overrides the normal noisgate remediation SLA for HIGH (180 days). The patch has been available since 2026-06-16 (98 days); there is no reason to wait.
ACL-restrict management interface to jump hosts only — Configure the switch's management ACL to accept HTTP/HTTPS/SNMP connections only from designated admin workstations or a bastion host. Even if the management VLAN is reachable, this limits exploitation to attackers who have compromised those specific admin hosts. Deploy within hours alongside VLAN isolation.
Audit for internet-exposed management interfaces — Query Shodan, Censys, or your ASM platform for any GS1900 management ports (TCP/80, TCP/443) exposed to the internet. Block these at the perimeter firewall immediately. ~3,500 devices are exposed globally — verify none are yours. Deploy within hours.
Deploy network configuration monitoring (RANCID/Oxidized) — Automated configuration backup with diff alerting will detect post-exploitation changes to VLAN assignments, port mirroring, spanning-tree, or ACL modifications. This is your detection layer for switches where no EDR exists. Deploy within 30 days per noisgate mitigation SLA for HIGH.
Enable SNMP traps for topology and config changes — Configure the switch to send SNMP traps to your SIEM for spanning-tree topology changes, VLAN modifications, and port status changes. These are indicators of post-exploitation activity. Deploy within 30 days.

What doesn't work

Host-based EDR on connected endpoints — EDR cannot inspect or detect compromise of the switch itself. It can only observe downstream effects like unusual ARP behavior or redirected traffic, and most EDR agents do not monitor for these network-layer indicators.
Generic WAF/IPS signatures — No Nuclei template, Snort rule, or vendor IPS signature exists for CVE-2026-7273 as of 2026-09-22. Generic HTTP buffer-overflow heuristics are unreliable against a targeted exploit payload.
Disabling SNMP on the switch — SNMP is not the vulnerable service. The CGI handler on the HTTP management interface is the attack surface. Disabling SNMP removes a reconnaissance channel but does not mitigate the vulnerability.
MAC address filtering on switch ports — MAC-based port security on downstream ports does not prevent an already-authenticated host from reaching the switch's management IP over the network. The attacker exploits the management plane, not the data plane.

06 · Verification

Crowdsourced verification payload.

Run on any Linux or macOS workstation with SNMP connectivity to your GS1900 switches. Requires snmpget from the net-snmp package. Invoke: bash check_cve_2026_7273.sh 192.168.1.1 public. No elevated privileges needed — just UDP/161 reachability to the target switch.

noisgate-verify.sh

BASHREAD-ONLYSAFE

#!/usr/bin/env bash
# check_cve_2026_7273.sh — Detect Zyxel GS1900 firmware vulnerable to CVE-2026-7273
# Usage: bash check_cve_2026_7273.sh <switch_ip> [snmp_community]
# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN

set -uo pipefail

TARGET="${1:-}"
COMMUNITY="${2:-public}"
OID_SYSDESCR="1.3.6.1.2.1.1.1.0"

if [[ -z "$TARGET" ]]; then
  printf 'Usage: %s <switch_ip> [snmp_community]\n' "$0"
  exit 2
fi

if ! command -v snmpget &>/dev/null; then
  echo "UNKNOWN - snmpget not found. Install: apt install snmp | brew install net-snmp"
  exit 2
fi

# Query sysDescr
RAW=$(snmpget -v2c -c "$COMMUNITY" -t 5 -r 2 -Oqv "$TARGET" "$OID_SYSDESCR" 2>&1) || {
  echo "UNKNOWN - SNMP query to $TARGET failed. Check reachability and community string."
  echo "Detail: $RAW"
  exit 2
}

echo "[*] sysDescr: $RAW"

# Verify this is a GS1900
if ! echo "$RAW" | grep -qi 'GS1900'; then
  echo "UNKNOWN - $TARGET does not appear to be a Zyxel GS1900 series switch."
  exit 2
fi

# Extract firmware version, e.g. 2.90(ABTQ.1)C0
FW=$(echo "$RAW" | grep -oE '[0-9]+\.[0-9]+\([A-Z]+\.[0-9]+\)[A-Z][0-9]') || true

if [[ -z "$FW" ]]; then
  echo "UNKNOWN - Could not parse firmware version from sysDescr."
  echo "Manually verify firmware >= 2.90(xxxx.2)C0 for your model."
  exit 2
fi

echo "[*] Firmware detected: $FW"

# Extract patch sublevel — the digit after the dot inside parentheses
PATCH=$(echo "$FW" | grep -oP '(?<=\.)[0-9]+(?=\))') || true

if [[ -z "$PATCH" ]]; then
  echo "UNKNOWN - Could not extract patch level from $FW."
  exit 2
fi

if (( PATCH >= 2 )); then
  echo "PATCHED - Firmware $FW (patch level $PATCH >= 2). CVE-2026-7273 is remediated."
  exit 0
else
  echo "VULNERABLE - Firmware $FW (patch level $PATCH < 2). CVE-2026-7273 applies!"
  echo "Action: Update to 2.90(xxxx.2)C0 for your model immediately."
  exit 1
fi

07 · Sources

Peer Review

What defenders are saying.

Submit a review attribution: handle + country only

0 flags selected · stored anonymously

Validation Results

Crowdsourced verification outputs.

Results submitted by users who ran the verification payload against their environment.