CVE-2026-7273 · Zyxel GS1900 Series Smart Managed Switch Stack-Based Buffer Overflow…

01 · The Real Story

Someone left the keys in the network closet and a burglar walked in through the office lobby

CVE-2026-7273 is a stack-based buffer overflow (CWE-121) in the CGI web-management program of all ten Zyxel GS1900 series smart managed switches — firmware versions through 2.90(XXXX.1)C0. An unauthenticated attacker on the same LAN segment (CVSS AV:A) can send a crafted HTTP POST to the management interface, overflow a fixed-size stack buffer, and execute arbitrary OS commands as root. Affected models span from the 8-port GS1900-8 to the 48-port GS1900-48HPv2. Zyxel shipped patched firmware (2.90(XXXX.2)C0) on June 16, 2026 — three months before the first documented exploitation wave.

Zyxel's HIGH / 8.8 rating is honest and accurate. The AV:A vector is legitimate — this is a LAN switch, not a perimeter appliance, and the management interface should not be internet-reachable by design. That said, GreyNoise documented a Chinese-speaking threat actor compromising 996 switches across 48 countries starting August 17, 2026, proving the management plane is routinely reachable from compromised or poorly segmented client VLANs. CISA added it to KEV on September 21 with a three-day remediation deadline — the fastest tier available. The vendor score of 8.8 correctly reflects the adjacent-network constraint, and the real-world exploitation confirms the threat is not theoretical. We leave the score unchanged at HIGH / 8.8.

"Actively exploited Zyxel switch RCE — patch now even though AV:A limits blast radius"

02 · The Attack Path

4 steps from start to impact.

STEP 01

Network adjacency to management interface

The attacker must be on the same Layer 2 segment or VLAN as the GS1900 management IP. In practice this means a compromised endpoint on a flat network, a guest/IoT VLAN that routes to the management subnet, or physical access to a port on the switch. The GreyNoise campaign suggests the actor had prior access — likely through a compromised host on the same segment or a separate initial-access vuln.

Conditions required:

Layer 2 or routed adjacency to the switch management IP
HTTP/HTTPS (port 80/443) reachable from the attacker's position

Where this breaks in practice:

Properly segmented management VLANs with ACLs block this entirely
Out-of-band management networks isolate the control plane
Requires prior compromise of a host on the same segment in most enterprise deployments

Detection/coverage: Network IDS signatures for oversized HTTP POST bodies to GS1900 CGI endpoints. GreyNoise published one IOC; a second is held pending victim coordination.

STEP 02

Send crafted HTTP POST to CGI program

The attacker sends a specially crafted HTTP POST request to the switch's web management CGI program. The request includes an oversized parameter that exceeds the fixed-size stack buffer. No authentication cookies or session tokens are required — the overflow occurs in the pre-auth parsing path. The known exploit is a PyArmor-obfuscated Python script that explicitly targets firmware versions 2.10 through 2.90.

Conditions required:

No authentication required (PR:N)
No user interaction required (UI:N)
Knowledge of the CGI endpoint and buffer offset (public since GreyNoise deobfuscation)

Where this breaks in practice:

WAF or reverse proxy in front of the management interface could block the oversized POST — but virtually nobody WAF-protects a LAN switch
The CGI binary has ASLR/stack canary status unknown on this embedded platform — likely absent given successful exploitation

Detection/coverage: HTTP request logging on the switch is minimal. Look for anomalous HTTP POST requests with unusually long parameters in network traffic captures (PCAP/IDS).

STEP 03

Stack buffer overflow → root command execution

The overflow corrupts the stack, hijacks control flow, and the attacker executes arbitrary OS commands as root on the switch's embedded Linux. The GS1900 runs a stripped-down Linux with BusyBox; root access gives complete control of the switching fabric. The exploit delivers commands inline rather than staging a separate payload, reducing forensic artifacts.

Conditions required:

Successful buffer overflow (no ASLR/canary on target)
Root-level execution context in the CGI process

Where this breaks in practice:

None once the overflow succeeds — the embedded OS has no EDR, no kernel hardening, no sandboxing

Detection/coverage: No endpoint detection capability exists on the switch. Detection must be network-based or via configuration-change monitoring.

STEP 04

Data exfiltration and persistence

With root shell access, the attacker exfiltrates three categories of data: (1) running configuration including VLAN assignments, ACLs, and spanning-tree topology, (2) network topology via LLDP/CDP neighbor tables and management IP schemes, and (3) hashed root management credentials for offline cracking. The attacker can also create local accounts, modify SNMP community strings, mirror traffic to a controlled port, and write changes to startup-config for reboot persistence. In the GreyNoise campaign, 564 of 996 compromised switches still ran factory default credentials.

Conditions required:

Root shell from step 3
Outbound network path for exfiltration (often the same segment)

Where this breaks in practice:

Configuration management tools that diff against known-good baselines would detect unauthorized changes
Egress filtering on the management VLAN could block exfil — but is rarely implemented for switch segments

Detection/coverage: Compare running-config against known-good snapshots. Monitor for new local accounts, changed SNMP community strings, and unexpected port-mirror configurations.

03 · Compensating Control

HIGH 8.8→LOW 3.5

SEVERITY REDUCED

Isolate switch management interfaces to a dedicated out-of-band management VLAN with ACLs — The entire attack chain requires Layer 2 or routed adjacency to the switch management IP. Moving management interfaces to a dedicated VLAN with strict ACLs (permit only jump hosts / NMS stations) breaks step 1 of the attack path. This is the single most effective compensating control and should be deployed immediately — within hours given the KEV listing and active exploitation. This control has lasting value even after patching.

HIGH 8.8→IGNORE 0.0

SEVERITY REDUCED

Apply firmware update to 2.90(XXXX.2)C0 on all 10 affected GS1900 models — The definitive fix. Each model has a specific patched firmware version (e.g., GS1900-48HPv2 → 2.90(ABTQ.2)C0). Given KEV listing and active exploitation, deploy immediately — within hours, not days. Schedule maintenance windows aggressively; the switch reboot is brief. Prioritize switches on flat networks or those carrying sensitive VLAN traffic.

HIGH 8.8→HIGH 7.5

Change all switch management credentials from factory defaults — 564 of 996 compromised switches ran factory default credentials. Even if CVE-2026-7273 is patched, factory defaults leave the management plane wide open to trivial credential-based attacks. Change root/admin passwords, SNMP community strings, and any shared management credentials immediately. Use unique per-device credentials managed by a password vault or NMS.

HIGH 8.8→HIGH 7.0

Disable HTTP management interface; use HTTPS-only with certificate pinning or SSH — The exploit targets the HTTP CGI program. Disabling plaintext HTTP management and restricting access to HTTPS-only (or SSH CLI) reduces the attack surface. While the overflow likely affects HTTPS as well (same CGI binary), disabling HTTP eliminates one path and forces TLS inspection for network-based detection. Deploy within hours alongside the management VLAN isolation.

HIGH 8.8→HIGH 8.0

Deploy network IDS signatures for oversized HTTP POST to GS1900 CGI endpoints — Create IDS/IPS rules matching HTTP POST requests to the GS1900 management CGI with abnormally large parameter values (the overflow trigger). This is a detection control, not prevention — it provides visibility into exploitation attempts. Deploy Suricata/Snort rules on the management VLAN span port or inline tap. Useful for hunting and incident response.

What doesn't work

WAF in front of the switch — nobody deploys a WAF protecting a LAN switch management interface. Even if you did, the GS1900's embedded web server doesn't support reverse-proxy configurations.
EDR/endpoint protection on the switch — the GS1900 runs a stripped-down embedded Linux with BusyBox. There is no agent, no telemetry, no kernel hardening. You cannot install endpoint protection on this device.
Firmware integrity monitoring — the GS1900 does not support secure boot or firmware attestation. An attacker with root access can modify the running system without triggering any integrity check.
Disabling the web management interface entirely — while this would block the exploit, it also removes the primary management path for these switches. Most GS1900 deployments rely on the web UI; the CLI is limited. This is impractical for ongoing operations.

04 · Intelligence Metadata

The supporting signals.

In-the-wild exploitation	Confirmed. GreyNoise documented a campaign starting August 17, 2026 — a Chinese-speaking threat actor (possibly linked to Red Heron group) compromised 996 GS1900 switches across 48 countries. Highest concentrations in Italy, United States, Taiwan, South Korea, and EU member states. SecurityWeek, Help Net Security
CISA KEV status	Listed September 21, 2026. CISA set a 3-day remediation deadline (September 24) under BOD 26-04 — the most aggressive tier. CISA alert
Proof-of-concept availability	Private exploit weaponized. The GreyNoise analysis deobfuscated a PyArmor-wrapped Python exploit that targets firmware 2.10–2.90 on GS1900-24 with CLI options for other models. No public GitHub PoC repos found on pocindex.io or GitHub search as of October 2026, but the deobfuscation details lower the reproduction barrier significantly.
EPSS score	0.02501 (≈97.5th percentile). EPSS rates this moderately likely to be exploited — consistent with the adjacent-network constraint limiting mass internet scanning, but the confirmed in-the-wild exploitation makes EPSS academic here.
CVSS vector interpretation	`CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` — Adjacent network, low complexity, no auth, no user interaction, unchanged scope, full CIA impact. The AV:A is the only friction element; everything else is worst-case.
Affected versions	All 10 GS1900 models, firmware `≤ 2.90(XXXX.1)C0`: GS1900-8, -8HP, -10HP, -16, -24, -24E, -24EP, -24HPv2, -48, -48HPv2. Exploit confirmed on firmware 2.10 through 2.90.
Fixed versions	Each model has a specific patch: `2.90(XXXX.2)C0`. Example: GS1900-48HPv2 → `2.90(ABTQ.2)C0`, GS1900-24 → `2.90(AAHL.2)C0`. All patches released June 16, 2026. No distro backports apply (embedded firmware).
Scanning / exposure data	ZoomEye query `app="Zyxel" && title="GS1900"` returned ~5,920 fingerprint matches — though many are behind NAT and not directly exploitable from the internet. The AV:A vector means internet-facing exposure is not the primary risk; the risk is from compromised hosts on the same LAN.
Disclosure timeline	Disclosed and patched June 16, 2026. Exploitation began August 17, 2026 (62-day gap). KEV listed September 21, 2026.
Reporting researchers	Lei Gu, Jun Cao, Zhiqing Rui, Jingzheng Wu, and Tianyue Luo from the Institute of Software, Chinese Academy of Sciences (ISCAS). Credited in the Zyxel advisory.

Sources.

05 · The Call

Final Verdict

= UNCHANGED to HIGH (8.8/10)

Why this verdict

AV:A is real friction but not a wall. The adjacent-network vector means no drive-by internet exploitation, but 996 switches were compromised in practice — the threat actor reached management interfaces through compromised LAN hosts or flat network topologies. This friction reduces the population at risk but does not eliminate it.
No authentication + no user interaction = low-effort exploitation. Once an attacker has LAN adjacency, the exploit is a single HTTP POST with no credentials. The PyArmor-obfuscated exploit automates the entire kill chain from scanning to exfiltration. The deobfuscation lowers the reproduction barrier further.
Root-level RCE on a network switch is inherently high-impact. The attacker gains the ability to intercept traffic, manipulate VLANs, pivot across segments, harvest credentials, and persist through reboots. The GS1900's embedded Linux has zero endpoint security — no EDR, no sandboxing, no kernel hardening.
Role multiplier: network infrastructure (Layer 2 access/distribution switch). (a) *Low-value role* — lab/test switch: exploitation gives access to test-segment traffic; impact is contained. (b) *Typical role* — SMB/branch office access switch: exploitation gives traffic interception and lateral movement across the local site; blast radius is host-to-site-level. (c) *High-value role* — switch carrying management VLAN traffic, inter-VLAN routing for a site with AD/file servers, or an OT/ICS flat-network segment: exploitation enables credential harvesting via traffic mirroring → potential domain compromise or OT-segment access. The GS1900 is an SMB-grade switch, NOT a canonical high-value-role component (it is not a perimeter appliance, IdP, hypervisor, or DC). However, ≥5% of GS1900 deployments carry traffic for segments containing domain-joined hosts or sensitive services, and compromise enables site-level lateral movement. The floor for HIGH is met when the chain succeeds in this role with a blast radius of site-to-domain-level. The floor for CRITICAL is NOT met because the GS1900 is not canonically a high-value-role component and AV:A prevents mass-internet exploitation.
KEV listing with active exploitation confirms real-world severity. The GreyNoise campaign, CISA's 3-day deadline, and 996 confirmed compromises make this unambiguously HIGH. No theoretical-only downgrades are appropriate.

Why not higher?

The GS1900 is a Layer 2 SMB/branch-office managed switch, not a perimeter edge appliance, identity provider, hypervisor, or domain controller. The AV:A vector means the attacker cannot exploit this from the internet without prior access to the local network — a compounding prerequisite that narrows the reachable population. While the blast radius on a single site can be significant (traffic interception, lateral movement), the GS1900 is not a canonical high-value-role component where ≥10% of installs occupy a fleet-critical or identity-critical position. CRITICAL would require either AV:N or a canonical high-value-role floor.

Why not lower?

Active exploitation is confirmed by GreyNoise with 996 devices compromised across 48 countries, CISA listed it on KEV with a 3-day deadline, and the exploit requires zero authentication and zero user interaction. Root-level RCE on a network switch gives the attacker traffic interception, VLAN manipulation, and credential harvesting capabilities that directly enable domain-level lateral movement. The 564 devices with factory default credentials underscore that the population running these switches often lacks basic security hygiene, amplifying the real-world risk. Any score below HIGH would be irresponsible given confirmed exploitation.

06 · Verification

Crowdsourced verification payload.

Run from any auditor workstation with SNMP or HTTP reachability to the target switch. No elevated privileges needed. Requires snmpget (net-snmp package) or curl. Usage: ./check_cve_2026_7273.sh 192.168.1.1 public

noisgate-verify.sh

BASHREAD-ONLYSAFE

#!/usr/bin/env bash
# CVE-2026-7273 Checker — Zyxel GS1900 Series Stack Buffer Overflow
# Outputs: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN
set -uo pipefail

TARGET="${1:-}"
COMMUNITY="${2:-public}"

if [[ -z "$TARGET" ]]; then
  echo "Usage: $0 <switch_ip> [snmp_community]"
  echo "Example: $0 192.168.1.1 public"
  exit 2
fi

FW_VERSION=""

# Attempt 1: SNMP sysDescr
if command -v snmpget &>/dev/null; then
  RAW=$(snmpget -v2c -c "$COMMUNITY" -t 5 -r 1 "$TARGET" \
        1.3.6.1.2.1.1.1.0 2>/dev/null || true)
  if echo "$RAW" | grep -qi 'GS1900'; then
    FW_VERSION=$(echo "$RAW" | grep -oP '\d+\.\d+\([A-Z]+\.\d+\)[A-Z]\d+' | head -1)
  fi
fi

# Attempt 2: HTTP login page banner (fallback)
if [[ -z "$FW_VERSION" ]] && command -v curl &>/dev/null; then
  PAGE=$(curl -sk --max-time 10 "https://${TARGET}/" 2>/dev/null || \
         curl -sk --max-time 10 "http://${TARGET}/" 2>/dev/null || true)
  if echo "$PAGE" | grep -qi 'GS1900'; then
    FW_VERSION=$(echo "$PAGE" | grep -oP '\d+\.\d+\([A-Z]+\.\d+\)[A-Z]\d+' | head -1)
  fi
fi

if [[ -z "$FW_VERSION" ]]; then
  echo "UNKNOWN — could not fingerprint firmware on $TARGET."
  echo "Confirm target is a Zyxel GS1900 with SNMP or HTTP reachable."
  exit 2
fi

echo "Detected firmware: $FW_VERSION on $TARGET"

# Extract build number inside parens, e.g. ABTQ.1 -> 1
BUILD_NUM=$(echo "$FW_VERSION" | grep -oP '\([A-Z]+\.(\d+)\)' | grep -oP '\.\K\d+')
MAJOR_MINOR=$(echo "$FW_VERSION" | grep -oP '^\d+\.\d+')

if [[ -z "$BUILD_NUM" || -z "$MAJOR_MINOR" ]]; then
  echo "UNKNOWN — could not parse firmware version format."
  exit 2
fi

# Vulnerable: <= 2.90(XXXX.1)C0   Patched: >= 2.90(XXXX.2)C0
MAJOR=$(echo "$MAJOR_MINOR" | cut -d. -f1)
MINOR=$(echo "$MAJOR_MINOR" | cut -d. -f2)

if (( MAJOR < 2 )) || { (( MAJOR == 2 )) && (( MINOR < 90 )); }; then
  echo "VULNERABLE — firmware $FW_VERSION is below the patched baseline."
  exit 1
elif (( MAJOR == 2 )) && (( MINOR == 90 )) && (( BUILD_NUM <= 1 )); then
  echo "VULNERABLE — firmware $FW_VERSION contains CVE-2026-7273."
  exit 1
else
  echo "PATCHED — firmware $FW_VERSION is at or above the fix level."
  exit 0
fi