Zyxel published a security advisory on 16 June 2026 for CVE-2026-7273, a stack-based buffer overflow in the CGI program of GS1900 series switches. On 21 September 2026 CISA added it to the KEV catalog with a due date of 24 September. The gap of three months between patch and KEV is a reminder that switch firmware gets updated last.
The bug lets a LAN-based, unauthenticated attacker run OS commands through a crafted HTTP request. NVD scores it 8.8 (AV:A, adjacent network).
What's affected
Zyxel lists these models, each affected at the version shown and earlier. Models not listed are unaffected.
| Model | Affected | Fixed |
|---|---|---|
| GS1900-8 | 2.90(AAHH.1)C0 | 2.90(AAHH.2)C0 |
| GS1900-8HP | 2.90(AAHI.1)C0 | 2.90(AAHI.2)C0 |
| GS1900-10HP | 2.90(AAZI.1)C0 | 2.90(AAZI.2)C0 |
| GS1900-16 | 2.90(AAHJ.1)C0 | 2.90(AAHJ.2)C0 |
| GS1900-24 | 2.90(AAHL.1)C0 | 2.90(AAHL.2)C0 |
| GS1900-24E | 2.90(AAHK.1)C0 | 2.90(AAHK.2)C0 |
| GS1900-24EP | 2.90(ABTO.1)C0 | 2.90(ABTO.2)C0 |
| GS1900-24HPv2 | 2.90(ABTP.1)C0 | 2.90(ABTP.2)C0 |
| GS1900-48 | 2.90(AAHN.1)C0 | 2.90(AAHN.2)C0 |
| GS1900-48HPv2 | 2.90(ABTQ.1)C0 | 2.90(ABTQ.2)C0 |
Zyxel lists no workarounds. The issue was reported by researchers at ISCAS.
What to do now
- Find every GS1900 switch, including closets and remote sites, and read the firmware version in the web interface.
- Install the fixed firmware for your model from the table.
- Until then, limit access to the switch web management interface to a dedicated management VLAN, and block it from user networks.
- Because exploitation needs LAN access, review who and what can reach the management page, including guest and IoT segments.
- The KEV entry carries the forensic triage flag, so check for configuration changes and unknown admin accounts on switches you could not patch quickly.
Quick check
Why does a LAN-only bug still land in KEV?
Attackers who already have a foothold on a network can reach the switch, and CISA lists vulnerabilities with evidence of exploitation regardless of whether access is remote or adjacent.
