CVE Details
CVE-2026-7273
Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability
Published: 2026-09-21
CVSS: 8.8 HIGH
Product: Zyxel GS1900 Series Switches
Due Date: 2026-09-24
Zyxel GS1900 series switches contain a stack-based buffer overflow vulnerability in the CGI program which could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.
GitHub PoC
Warning: GitHub PoC repositories are unverified. Some may be fake
or contain malware. Use caution and review code before running anything.
No GitHub PoC data.
FIRST EPSS
EPSS estimates the probability of exploitation in the next 30 days. Higher values indicate higher likelihood of real-world exploitation.
Timeline
CVE Stalker
KEV
MITRE
GitHub
FIRST (EPSS)
MITRE
CVSS
SSVC
References
Show Raw Data
| Key | Remaining Key | Value |
|---|---|---|
| dataType | CVE_RECORD | |
| dataVersion | 5.2 | |
| cveMetadata > | cveId | CVE-2026-7273 |
| cveMetadata > | assignerOrgId | 96e50032-ad0d-4058-a115-4d2c13821f9f |
| cveMetadata > | state | PUBLISHED |
| cveMetadata > | assignerShortName | Zyxel |
| cveMetadata > | dateReserved | 2026-04-28T06:21:36.574Z |
| cveMetadata > | datePublished | 2026-06-16T02:20:29.847Z |
| cveMetadata > | dateUpdated | 2026-09-21T19:58:23.175Z |
| containers > | cna > providerMetadata > orgId | 96e50032-ad0d-4058-a115-4d2c13821f9f |
| containers > | cna > providerMetadata > shortName | Zyxel |
| containers > | cna > providerMetadata > dateUpdated | 2026-06-16T02:20:29.847Z |
| containers > | cna > problemTypes > 0 > descriptions > 0 > lang | en |
| containers > | cna > problemTypes > 0 > descriptions > 0 > cweId | CWE-121 |
| containers > | cna > problemTypes > 0 > descriptions > 0 > description | CWE-121 Stack-based buffer overflow |
| containers > | cna > problemTypes > 0 > descriptions > 0 > type | CWE |
| containers > | cna > affected > 0 > vendor | Zyxel |
| containers > | cna > affected > 0 > product | GS1900-48HPv2 firmware |
| containers > | cna > affected > 0 > versions > 0 > status | affected |
| containers > | cna > affected > 0 > versions > 0 > version | <= 2.90(ABTQ.1)C0 |
| containers > | cna > affected > 0 > defaultStatus | unaffected |
| containers > | cna > affected > 1 > vendor | Zyxel |
| containers > | cna > affected > 1 > product | GS1900-8 firmware |
| containers > | cna > affected > 1 > versions > 0 > status | affected |
| containers > | cna > affected > 1 > versions > 0 > version | <= 2.90(AAHH.1)C0 |
| containers > | cna > affected > 1 > defaultStatus | unaffected |
| containers > | cna > affected > 2 > vendor | Zyxel |
| containers > | cna > affected > 2 > product | GS1900-8HP firmware |
| containers > | cna > affected > 2 > versions > 0 > status | affected |
| containers > | cna > affected > 2 > versions > 0 > version | <= 2.90(AAHI.1)C0 |
| containers > | cna > affected > 2 > defaultStatus | unaffected |
| containers > | cna > affected > 3 > vendor | Zyxel |
| containers > | cna > affected > 3 > product | GS1900-10HP firmware |
| containers > | cna > affected > 3 > versions > 0 > status | affected |
| containers > | cna > affected > 3 > versions > 0 > version | <= 2.90(AAZI.1)C0 |
| containers > | cna > affected > 3 > defaultStatus | unaffected |
| containers > | cna > affected > 4 > vendor | Zyxel |
| containers > | cna > affected > 4 > product | GS1900-16 firmware |
| containers > | cna > affected > 4 > versions > 0 > status | affected |
| containers > | cna > affected > 4 > versions > 0 > version | <= 2.90(AAHJ.1)C0 |
| containers > | cna > affected > 4 > defaultStatus | unaffected |
| containers > | cna > affected > 5 > vendor | Zyxel |
| containers > | cna > affected > 5 > product | GS1900-24 firmware |
| containers > | cna > affected > 5 > versions > 0 > status | affected |
| containers > | cna > affected > 5 > versions > 0 > version | <= 2.90(AAHL.1)C0 |
| containers > | cna > affected > 5 > defaultStatus | unaffected |
| containers > | cna > affected > 6 > vendor | Zyxel |
| containers > | cna > affected > 6 > product | GS1900-24E firmware |
| containers > | cna > affected > 6 > versions > 0 > status | affected |
| containers > | cna > affected > 6 > versions > 0 > version | <= 2.90(AAHK.1)C0 |
| containers > | cna > affected > 6 > defaultStatus | unaffected |
| containers > | cna > affected > 7 > vendor | Zyxel |
| containers > | cna > affected > 7 > product | GS1900-24EP firmware |
| containers > | cna > affected > 7 > versions > 0 > status | affected |
| containers > | cna > affected > 7 > versions > 0 > version | <= 2.90(ABTO.1)C0 |
| containers > | cna > affected > 7 > defaultStatus | unaffected |
| containers > | cna > affected > 8 > vendor | Zyxel |
| containers > | cna > affected > 8 > product | GS1900-24HPv2 firmware |
| containers > | cna > affected > 8 > versions > 0 > status | affected |
| containers > | cna > affected > 8 > versions > 0 > version | <= 2.90(ABTP.1)C0 |
| containers > | cna > affected > 8 > defaultStatus | unaffected |
| containers > | cna > affected > 9 > vendor | Zyxel |
| containers > | cna > affected > 9 > product | GS1900-48 firmware |
| containers > | cna > affected > 9 > versions > 0 > status | affected |
| containers > | cna > affected > 9 > versions > 0 > version | <= 2.90(AAHN.1)C0 |
| containers > | cna > affected > 9 > defaultStatus | unaffected |
| containers > | cna > descriptions > 0 > lang | en |
| containers > | cna > descriptions > 0 > value | A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request. |
| containers > | cna > descriptions > 0 > supportingMedia > 0 > type | text/html |
| containers > | cna > descriptions > 0 > supportingMedia > 0 > base64 | False |
| containers > | cna > descriptions > 0 > supportingMedia > 0 > value | A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request. |
| containers > | cna > references > 0 > url | https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-stack-based-buffer-overflow-vulnerability-in-gs1900-series-switches-06-16-2026 |
| containers > | cna > references > 0 > tags > 0 | vendor-advisory |
| containers > | cna > metrics > 0 > format | CVSS |
| containers > | cna > metrics > 0 > scenarios > 0 > lang | en |
| containers > | cna > metrics > 0 > scenarios > 0 > value | GENERAL |
| containers > | cna > metrics > 0 > cvssV3_1 > version | 3.1 |
| containers > | cna > metrics > 0 > cvssV3_1 > attackVector | ADJACENT_NETWORK |
| containers > | cna > metrics > 0 > cvssV3_1 > attackComplexity | LOW |
| containers > | cna > metrics > 0 > cvssV3_1 > privilegesRequired | NONE |
| containers > | cna > metrics > 0 > cvssV3_1 > userInteraction | NONE |
| containers > | cna > metrics > 0 > cvssV3_1 > scope | UNCHANGED |
| containers > | cna > metrics > 0 > cvssV3_1 > confidentialityImpact | HIGH |
| containers > | cna > metrics > 0 > cvssV3_1 > integrityImpact | HIGH |
| containers > | cna > metrics > 0 > cvssV3_1 > availabilityImpact | HIGH |
| containers > | cna > metrics > 0 > cvssV3_1 > baseSeverity | HIGH |
| containers > | cna > metrics > 0 > cvssV3_1 > baseScore | 8.8 |
| containers > | cna > metrics > 0 > cvssV3_1 > vectorString | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| containers > | cna > source > discovery | UNKNOWN |
| containers > | cna > x_generator > engine | Vulnogram 1.0.2 |
| containers > | adp > 0 > metrics > 0 > other > type | ssvc |
| containers > | adp > 0 > metrics > 0 > other > content > id | CVE-2026-7273 |
| containers > | adp > 0 > metrics > 0 > other > content > role | CISA Coordinator |
| containers > | adp > 0 > metrics > 0 > other > content > options > 0 > Exploitation | active |
| containers > | adp > 0 > metrics > 0 > other > content > options > 1 > Automatable | no |
| containers > | adp > 0 > metrics > 0 > other > content > options > 2 > Technical Impact | total |
| containers > | adp > 0 > metrics > 0 > other > content > version | 2.0.3 |
| containers > | adp > 0 > metrics > 0 > other > content > timestamp | 2026-09-21T19:40:05.862596Z |
| containers > | adp > 0 > metrics > 1 > other > type | kev |
| containers > | adp > 0 > metrics > 1 > other > content > dateAdded | 2026-09-21 |
| containers > | adp > 0 > metrics > 1 > other > content > reference | https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-7273 |
| containers > | adp > 0 > references > 0 > url | https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation |
| containers > | adp > 0 > references > 0 > tags > 0 | third-party-advisory |
| containers > | adp > 0 > references > 1 > url | https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-7273 |
| containers > | adp > 0 > references > 1 > tags > 0 | government-resource |
| containers > | adp > 0 > title | CISA ADP Vulnrichment |
| containers > | adp > 0 > providerMetadata > orgId | 134c704f-9b21-4f2e-91b3-4a467353bcc0 |
| containers > | adp > 0 > providerMetadata > shortName | CISA-ADP |
| containers > | adp > 0 > providerMetadata > dateUpdated | 2026-09-21T19:58:23.175Z |
| containers > | adp > 0 > timeline > 0 > time | 2026-09-21T00:00:00.000Z |
| containers > | adp > 0 > timeline > 0 > lang | en |
| containers > | adp > 0 > timeline > 0 > value | CVE-2026-7273 added to CISA KEV |