CVE-2026-7273

Name of the Vulnerable Software and Affected Versions Zyxel GS1900-8 versions prior to 2.90(AAHH.2)C0 Zyxel GS1900-8HP versions prior to 2.90(AAHI.2)C0 Zyxel GS1900-10HP versions prior to 2.90(AAZI.2)C0 Zyxel GS1900-16 versions prior to 2.90(AAHJ.2)C0 Zyxel GS1900-24 versions prior to 2.90(AAHL.2)C0 Zyxel GS1900-24E versions prior to 2.90(AAHK.2)C0 Zyxel GS1900-24EP versions prior to 2.90(ABTO.2)C0 Zyxel GS1900-24HPv2 versions prior to 2.90(ABTP.2)C0 Zyxel GS1900-48 versions prior to 2.90(AAHN.2)C0 Zyxel GS1900-48HPv2 versions prior to 2.90(ABTQ.2)C0

Description A stack-based buffer overflow exists in the CGI web-management program of Zyxel GS1900 series switches. A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than the buffer can hold, potentially overwriting adjacent memory. An unauthenticated attacker on the local area network can exploit this by sending a specially crafted HTTP request to the management interface, which may lead to the execution of arbitrary operating system commands. Real-world exploitation has been documented, with approximately 996 devices across 48 countries affected by a campaign aimed at stealing configurations, network information, and hashed root credentials.

Recommendations Update Zyxel GS1900-8 to version 2.90(AAHH.2)C0. Update Zyxel GS1900-8HP to version 2.90(AAHI.2)C0. Update Zyxel GS1900-10HP to version 2.90(AAZI.2)C0. Update Zyxel GS1900-16 to version 2.90(AAHJ.2)C0. Update Zyxel GS1900-24 to version 2.90(AAHL.2)C0. Update Zyxel GS1900-24E to version 2.90(AAHK.2)C0. Update Zyxel GS1900-24EP to version 2.90(ABTO.2)C0. Update Zyxel GS1900-24HPv2 to version 2.90(ABTP.2)C0. Update Zyxel GS1900-48 to version 2.90(AAHN.2)C0. Update Zyxel GS1900-48HPv2 to version 2.90(ABTQ.2)C0. Restrict management access to only trusted administration sources and remove unnecessary external exposure.