> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # CVE-2026-7273 Zyxel GS1900 Series Switches: Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability - URL: https://f4n6.co.uk/security-feed/cve-2026-7273-zyxel-gs1900-series-switches-zyxel-gs1900-series-switches-stack-based-buffer-overflow-vulnerability/ - Published: 2026-09-21T21:37:33.000Z - Updated: 2026-09-21T21:37:33.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-7273 ## 1\. Executive summary CVE-2026-7273 is a stack-based buffer overflow (CWE-121) in the CGI program of Zyxel GS1900 series switches. A LAN-based, unauthenticated attacker can trigger the flaw with a crafted HTTP request and potentially execute OS commands on the device. NVD scores it CVSS 8.8 HIGH; it is not in the CISA KEV catalogue and EPSS is currently 0%, so there is no evidence of active exploitation at time of writing. The exposure is real but conditional: the attack path requires LAN reachability to the switch's web management interface, which limits the attack surface for most EMEA financial services deployments to internal networks and any misconfigured management segments. ## 2\. Regulatory framing No specific DORA/NIS2 article is directly engaged by this item. The item is a pre-exploitation vulnerability advisory with no reported incident, no third-party provider relationship specific to Zyxel, and no evidence of compromise; generic patching obligations do not meet the trigger test for the articles in scope. ## 3\. Technical analysis & attack chain The vulnerability sits in the CGI program that handles HTTP requests to the switch's web management interface. The flaw is a stack-based buffer overflow: the CGI program accepts an HTTP request whose content overflows a stack-allocated buffer, and a sufficiently crafted request can overwrite adjacent stack memory and potentially redirect execution to attacker-supplied OS commands. The attacker needs no credentials. The single confirmed precondition is network reachability to the switch from the LAN side. Confirmed attack chain: 1. The attacker must first be on the LAN segment where the GS1900 switch is reachable, or have routed access to its management interface. 2. The attacker sends a crafted HTTP request to the switch's web management interface. 3. The CGI program mishandles the request content, overflowing a stack buffer. 4. Successful exploitation potentially allows execution of OS commands on the switch's operating system. The word "potentially" in the vendor and NVD text is doing real work. The sources confirm the overflow and the unauthenticated, LAN-based attack path, but they do not confirm reliable command execution, and they give no information on which specific HTTP parameters, headers, or request fields trigger the overflow. The affected firmware versions are not stated in the source material. The CISA-published remediation due date of 2026-09-24 applies to US federal agencies under BOD 26-04; it is not a CISA KEV entry date and should not be read as evidence of exploitation. This advisory rests on a single NVD entry with no vendor advisory, exploit code, or third-party research in the source set. Treat the technical detail above as single-sourced; verify against Zyxel's own security advisory before enforcement action. ## 4\. Mitigation & containment **P1 (within 24h):** Inventory GS1900 series switches in estate. Identify every unit with its web management interface reachable from user LAN segments, guest networks, or any segment where unauthenticated hosts can route to it. Restrict management access to a dedicated management VLAN reachable only from administrative workstations and jump hosts; apply ACLs on upstream routers and firewalls to block HTTP/HTTPS to the switch management IP from all other subnets. **P2 (within 72h):** Disable the web management interface on GS1900 units where CLI management over SSH (or console) is a workable substitute, eliminating the vulnerable CGI program's exposure entirely. Where the web interface must stay, confirm the firmware version against Zyxel's security advisory once identified and apply the vendor patch. The source material does not name a fixed firmware version; obtain it directly from Zyxel before scheduling change windows. **P3 (within 7 days):** Add the GS1900 management IP range to network monitoring for unexpected HTTP sessions from non-management source addresses, and for outbound connections from switch management IPs, which would indicate successful command execution. Fold the device class into the next cycle of DORA Art. 24 digital operational resilience testing, specifically testing whether management interfaces on network hardware are reachable from general user segments. ## 5\. Indicators of compromise No indicators of compromise available in the source material. ## 6\. Detection Insufficient indicators to author detection rules. ## CVE assessment 1 referenced CVE | CVE | CVSS | Exploited | EPSS | Summary | | ------------------------------------------------------------------------------ | -------- | --------- | ---- | ------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-7273](https://nvd.nist.gov/vuln/detail/CVE-2026-7273?ref=f4n6.co.uk) | 8.8 High | — | 0% | A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0… | ## 7\. Sources - NVD, CVE-2026-7273 — Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability, https://nvd.nist.gov/vuln/detail/CVE-2026-7273, 2026-09-20 - CISA, vulnerability summary and required action (BOD 26-04 guidance), as republished in the NVD entry, https://nvd.nist.gov/vuln/detail/CVE-2026-7273, 2026-09-20 ## 8\. Adverse Trace position We assess CVE-2026-7273 as a high-severity vulnerability (CVSS 8.8) with currently low likelihood of exploitation against EMEA financial services targets: it is not in CISA KEV, EPSS is 0%, and the attack path requires LAN access to the switch management interface rather than internet exposure. The absence of a named fixed firmware version in the source material is the main gap; clients should not treat this as patched until Zyxel's advisory confirms the remediation version for their specific GS1900 model. We will monitor for a Zyxel vendor advisory, any KEV listing, and proof-of-concept code, and will reissue this note if exploitation is observed or the affected version range is published. --- [Read the original source →](https://nvd.nist.gov/vuln/detail/CVE-2026-7273?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*