Zyxel GS1900 Series Switch CGI Stack-based Buffer Overflow Remote Code Execution (RCE) Advisory (CVE-2026-7273)

Affected Vendors

Zyxel

Affected Components

GS1900-48HPv2, GS1900 Series Switches

Published Date

2026-06-16

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Zyxel GS1900-48HPv2 firmware versions up to 2.90(ABTQ.1)C0.

Impact

Unauthenticated LAN-based attackers can execute arbitrary OS commands and gain full control of the device via crafted HTTP requests.

Mitigation

Immediately update to the latest patched firmware and restrict access to the management interface using ACLs.

Affected Products & Version Scope

Zyxel GS1900-48HPv2 and other GS1900 series switches running firmware version 2.90(ABTQ.1)C0 or earlier.

Remediation & Live Workaround Commands

PATCH & WORKAROUND

Firmware Update: Download and apply the latest firmware (e.g., V2.90(ABTQ.2)C0 or higher) from the Zyxel Support Portal. 2. Access Control: Implement Access Control Lists (ACLs) to ensure only authorized IP addresses can access the Web GUI. 3. Disable Unnecessary Services: Turn off HTTP/HTTPS management services if they are not required for daily operations or isolate them within a management VLAN.

Recommended Security Control & Mitigation Partner

NordLayer / Zero-Trust Network Access

Apply the vendor-supplied security patches immediately and review network segmentation policies for management interfaces.

Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access

Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.

90% Attack Surface Reduction · Hardware-Free

Explore Zero-Trust Network Access Plans

Technical Root Cause & Exploitation Mechanics

The vulnerability stems from insufficient input validation within the CGI program used by the Zyxel GS1900 series web management interface. By sending a specially crafted HTTP request with oversized parameters, an attacker can trigger a stack-based buffer overflow (CWE-121). This allows for the overwriting of return addresses and execution of arbitrary system commands. Given its inclusion in the CISA KEV catalog and a high EPSS score of 0.94, this flaw is actively being exploited in the wild.

Official Vendor Advisories & References

NVD Original English Description

A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-stack-based-buffer-overflow-vulnerability-in-gs1900-series-switches-06-16-2026

Source: security@zyxel.com.tw · Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-7273

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Third Party Advisory, US Government Resource

https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Exploit, Third Party Advisory

SecOps Advisory Dispatch & RSS Feed

Subscribe to Daily Vulnerability Briefings & KEV Alerts

Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.

Slack / Teams / RSS Feed: