1. Executive summary
CVE-2026-7273, a stack-based buffer overflow in ZyXEL GS1900 switches (CVSS 8.8, high severity), is being actively exploited: GreyNoise observed a Chinese threat actor running an obfuscated Python exfiltration script against 996 vulnerable devices across 48 countries in August 2026. The flaw is pre-authentication and allows OS command execution via crafted HTTP requests, and CISA added it to the KEV catalog on 2026-09-21 with a three-day federal patching deadline under BOD 26-04. The actor stole hashed root credentials, device configuration and networking information; 564 of the compromised devices were still running factory default credentials. The attribution to a "Chinese threat actor" is unconfirmed: the actor has no MITRE ATT&CK profile in our verified reference data, and the GreyNoise assessment that it is the same as or related to the Red Heron group is single-sourced. EMEA financial services firms running GS1900 switches on firmware 2.10 through 2.90 should treat this as an immediate patch-and-verify action.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 19: reporting of major ICT-related incidents to competent authorities | Active exploitation of CVE-2026-7273 has exfiltrated hashed root credentials and configuration data from nearly 1,000 internet-exposed switches, including devices in 48 countries; a firm with a confirmed-compromised GS1900 must assess whether this crosses its major-incident threshold | Firms with compromised devices need to run the Art. 19 classification and, if thresholds are met, report within the regulatory timelines rather than treating this as routine patching |
| DORA Art. 24: digital operational resilience testing — general requirements | The vulnerability was exploitable without authentication on firmware that had a vendor fix available since June, and 564 compromised devices still ran factory default credentials | The finding that fixes shipped in June but exploitation occurred in August supports an Art. 24-driven review of whether internet-facing network device patching and default-credential checks are inside the tested scope of resilience testing |
No NIS2 or UK NIS article is engaged by a fact distinctive to this item beyond what DORA already covers for in-scope financial entities.
3. Technical analysis & attack chain
Confirmed chain, as reported by GreyNoise via SecurityWeek:
- Reconnaissance and targeting of internet-exposed ZyXEL GS1900 switches, firmware versions 2.10 through 2.90, across 48 countries.
- Exploitation of CVE-2026-7273, an unauthenticated stack-based buffer overflow reachable through crafted HTTP requests, yielding OS command execution on the switch.
- Execution of a heavily obfuscated Python script. The script explicitly targets firmware 2.10-2.90 of the GS1900-24 but exposes command-line options (libc base address, global offsets) that allow retargeting other firmware in the vulnerability's scope.
- Exfiltration of hashed root credentials, device configuration details and networking information from 996 devices.
- Post-compromise exposure: 564 of the 996 compromised devices still had factory default credentials, so the actor holds credential material that may permit direct re-entry without re-exploiting the CVE.
ZyXEL released patches for ten GS1900 switch models in June 2026. Exploitation occurred in August, roughly two months after the fix was available, which points to unpatched, internet-facing estate rather than a zero-day window.
Two caveats on this section. First, the entire exploitation narrative, the device count, the script description and the 564 default-credential figure are single-sourced, from GreyNoise as reported by SecurityWeek; we have no second vendor corroborating the IOC-level detail, so treat the specifics as directional until verified against your own telemetry. Second, the attribution is unconfirmed: the actor has no MITRE ATT&CK profile in our verified reference data, and the claim that it is the same as or closely related to the Red Heron group (observed by Acronis exploiting a Gitea vulnerability) is GreyNoise's assessment alone. The same actor was also reported using a chain of Ubiquiti vulnerabilities leading to RCE and targeting WordPress installations in July against small business and government entities, including a theft of more than 18,000 sensitive records from a western governmental organization's backend database. None of that activity is reported against financial services targets, but it indicates the group's scope is broader than one CVE.
4. Mitigation & containment
P1, within 24 hours:
- Inventory your estate for ZyXEL GS1900 switches, all ten affected models, and record firmware versions. Any device on firmware 2.10 through 2.90 is in scope.
- Apply the ZyXEL security updates released in June 2026 to every GS1900 in scope. This is the vendor fix; there is no indication of an alternative mitigation in the source material.
- Block management-plane HTTP access to GS1900 switches from untrusted networks, especially the internet. The vulnerability is reached via crafted HTTP requests without authentication, so removing HTTP exposure cuts the known attack path.
- Rotate all credentials on GS1900 switches, not only those on confirmed-compromised devices. The actor exfiltrated hashed root credentials, and 564 compromised devices had factory defaults, so assume credential exposure estate-wide until verified.
- Check every GS1900 for factory default credentials and replace them. This closes the re-entry path that does not depend on the CVE.
P2, within 72 hours:
- Hunt for signs of prior exploitation: review HTTP request logs and device configuration-change history on GS1900 switches for the August 2026 window and since June 2026, when the patch was available.
- If a device is confirmed compromised, treat its configuration and credential material as disclosed and re-baseline the device: reflash to patched firmware, restore known-good configuration, rotate credentials again, and review anything the switch could reach on its segments.
- Verify that switches previously exposed to the internet are now reachable only from defined management networks.
P3, within 7 days:
- Fold GS1900 firmware and default-credential checks into routine network-device audits, so the June-patch-to-August-exploitation gap does not repeat.
- Confirm your vulnerability management process ingests CISA KEV additions with their remediation deadlines; this entry carried a three-day deadline under BOD 26-04 for US federal agencies, and it is a reasonable internal clock for exposed devices even where BOD 26-04 does not apply.
5. Indicators of compromise
No indicators of compromise available in the source material. The source describes the exploitation tool (a heavily obfuscated Python script) and the data types exfiltrated, but publishes no hashes, domains, IP addresses, file paths or command-line strings for it.
6. Detection
Insufficient indicators to author detection rules. The source gives no strings, file names, hashes, registry keys or network signatures from the malicious script; the only technical artefacts are the affected product, firmware range and HTTP-based attack vector, which are product facts rather than threat artefacts.
7. Sources
- SecurityWeek, "Recent ZyXEL Switch Vulnerability Exploited by Chinese Hackers", https://www.securityweek.com/recent-zyxel-switch-vulnerability-exploited-by-chinese-hackers/, 2026-09-22
8. Adverse Trace position
We assess this as a high-severity, actively exploited vulnerability (CVSS 8.8, CISA KEV listed as of 2026-09-21) with confirmed credential and configuration theft at scale, and the practical risk to EMEA financial services is concentrated in any firm running GS1900 access-layer switches with unpatched firmware or default credentials exposed to the internet; the absence of published IOCs means detection must rely on patch state, credential hygiene and HTTP exposure rather than signature matching, and the single-sourced GreyNoise reporting plus the unconfirmed actor attribution mean enforcement actions built on the campaign narrative should be verified against internal telemetry first. We will monitor for a GreyNoise technical write-up with script artefacts and IOCs, for corroboration of the Red Heron relationship, and for any indication of targeting beyond the reported small business, government and western governmental organization victims, and we will reissue this advisory if indicators become available.
Published via PulseTrace — Adverse Trace threat intelligence.