A Zyxel GS1900 vulnerability has been used to breach 996 network switches across 48 countries. The flaw, tracked as CVE-2026-7273, lets an attacker on the local network run commands on the switch without a password. Zyxel released a fix on 16 June 2026.
What the Flaw Lets an Attacker Do
CVE-2026-7273 is a stack-based buffer overflow in the web management interface of the switch. In plain terms, a specially shaped web request overruns a fixed-size area of memory and overwrites instructions the device then runs.
Zyxel, the Taiwanese networking manufacturer, describes the result as allowing “a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request”. Two details in that sentence matter. Unauthenticated means no login is needed. LAN-based means the attacker has to already reach the switch’s management interface, so a device exposed to the open internet is at far greater risk than one behind a firewall. The vulnerability carries a CVSS severity score of 8.8 out of 10.
Which Zyxel Switches Are Affected
Ten GS1900 models are affected, each with its own firmware build. Zyxel’s security advisory of 16 June 2026 lists the patched version for each.
| Model | Vulnerable firmware | Patched firmware |
|---|---|---|
| GS1900-8 | 2.90(AAHH.1)C0 and earlier | 2.90(AAHH.2)C0 |
| GS1900-8HP | 2.90(AAHI.1)C0 and earlier | 2.90(AAHI.2)C0 |
| GS1900-10HP | 2.90(AAZI.1)C0 and earlier | 2.90(AAZI.2)C0 |
| GS1900-16 | 2.90(AAHJ.1)C0 and earlier | 2.90(AAHJ.2)C0 |
| GS1900-24 | 2.90(AAHL.1)C0 and earlier | 2.90(AAHL.2)C0 |
| GS1900-24E | 2.90(AAHK.1)C0 and earlier | 2.90(AAHK.2)C0 |
| GS1900-24EP | 2.90(ABTO.1)C0 and earlier | 2.90(ABTO.2)C0 |
| GS1900-24HPv2 | 2.90(ABTP.1)C0 and earlier | 2.90(ABTP.2)C0 |
| GS1900-48 | 2.90(AAHN.1)C0 and earlier | 2.90(AAHN.2)C0 |
| GS1900-48HPv2 | 2.90(ABTQ.1)C0 and earlier | 2.90(ABTQ.2)C0 |
The GS1900 line is sold as smart managed switches for small offices, branch sites and home networks, which is why the compromised devices are spread across so many countries rather than concentrated in large enterprises.
What the Attackers Took
The intrusions did not stop at access. According to the threat intelligence firm GreyNoise, which published the research behind these figures, the attacker ran a file transfer utility on each compromised switch to pull data off it.
- Configuration files: The full working configuration of the switch, including how the network behind it is arranged.
- Networking information: Details of the devices and segments the switch connects.
- Hashed root credentials: The scrambled form of the administrator password, which can be attacked offline at leisure.
GreyNoise reported that 564 of the victims were still using factory default credentials, meaning no password cracking was needed at all. It also found the exploit code inside a Python script obfuscated with the commercial tool PyArmor. GreyNoise attributes the activity to a suspected Chinese-speaking actor; no government has made a formal attribution.
The compromises took place on or about 17 August 2026, two months after the fix was available.
Who the 24 September Deadline Applies To
The United States Cybersecurity and Infrastructure Security Agency added CVE-2026-7273 to its Known Exploited Vulnerabilities catalog on 21 September 2026 with a due date of 24 September 2026.
That deadline binds United States federal civilian agencies only. It has no legal force over a business or an individual anywhere in the world. Its value to everyone else is as a signal: CISA adds an entry only once it has evidence of exploitation in the wild, so the listing confirms this is being used, not merely possible.
As of 23 September 2026, Zyxel’s advisory remains the June release with no revision, and CISA lists the ransomware status for this entry as unknown. Readers who follow these listings may recognise the pattern from the recent Cisco ISE vulnerability and the PaperCut server campaign.
What to Do If You Run a GS1900 Switch
Patching closes the hole, but it does not undo a theft that already happened. If your switch was reachable and unpatched in August, treat the credentials on it as compromised.
- Sign in to the switch’s web interface and check the firmware version against the table above.
- If it is a .1 build or earlier, download the matching .2 build from Zyxel’s support site and apply it.
- Change the root and administrator passwords after patching, not before. A password changed on an unpatched device can be taken again.
- If the switch still uses factory default credentials, change them now regardless of firmware version.
- Remove the management interface from the public internet, and restrict it to a management network or VLAN.
- Review the configuration for accounts, SNMP community strings or port mirroring you did not set up.
- Rotate any shared credentials, such as SNMP strings or RADIUS secrets, that appear in the switch configuration, because the configuration file itself was among the data taken.
What Is Still Unknown
Several points remain open as of 23 September 2026.
- Identity of the attacker: GreyNoise describes a suspected Chinese-speaking actor. No official attribution has been published.
- Purpose: Neither GreyNoise nor CISA has said what the stolen configurations were used for afterwards.
- Victim notification: No process has been announced for telling the owners of the 996 switches that they were affected.
- End-of-support models: Zyxel’s advisory covers devices within their support period. Owners of older GS1900 units outside support should assume no fix is coming.
Frequently Asked Questions
What Is the Zyxel GS1900 Vulnerability?
CVE-2026-7273 is a stack-based buffer overflow in the web management interface of Zyxel GS1900 switches. It lets an unauthenticated attacker on the local network run operating system commands on the device. It scores 8.8 on the CVSS scale.
Which Firmware Fixes CVE-2026-7273?
Each model has its own build. The fix is the .2 revision of firmware 2.90 for that model, for example 2.90(AAHL.2)C0 for the GS1900-24. Zyxel published these on 16 June 2026.
How Many Zyxel Switches Were Compromised?
GreyNoise counted 996 compromised switches across 48 countries, with the activity dated on or about 17 August 2026. Italy, the United States, Taiwan and South Korea were among the most affected.
Does the CISA Deadline Apply to Me?
Only if you run a United States federal civilian agency network. For everyone else the 24 September 2026 date is advisory, though the listing confirms the flaw is being exploited in the wild.
Is Patching Enough After This Attack?
No. The attacker took hashed root credentials and configuration files from compromised devices, so passwords and any shared secrets stored in the configuration should be changed after the firmware is updated.
