October 4, 2026: CISA lists CVE-2026-7273 as exploited: an unauthenticated attacker on the LAN can send a crafted HTTP request to the CGI program in affected Zyxel GS1900 switch firmware and potentially execute operating-system commands. The agency listed it on September 21 with a September 24 action date. With that date past, record each affected switch’s exact model, running firmware and management reachability so you can select the right patch and restrict access.
Zyxel published patches in June for ten models. The patch varies by model, even where each release starts with 2.90. The vendor also says “on-market products not listed in the table remain unaffected.” That limits the version check to its named models; the access check belongs on any management interface reachable from untrusted client networks.
A LAN request reaches CGI
A managed switch often serves an HTTP management page to administrators. Here the affected component is the switch firmware’s CGI program. Zyxel describes a stack-based buffer overflow that an unauthenticated LAN attacker could reach with a crafted HTTP request, with possible OS-command execution. The Zyxel-assigned CVE record rates the flaw 8.8 under CVSS 3.1 and classifies the attack vector as adjacent network. Human attackers still need a path to the management service. A compromised workstation on a VLAN that can open that service has such a path.
No CVE-specific request pattern or compromise indicator is available for this hunt. For a switch with suspicious management activity, preserve its configuration and available management, authentication and network-flow logs for incident triage.
Ten models need specific firmware
Read the specific model and running build from the switch’s management interface or asset inventory, then compare its branch with Zyxel’s affected and patched builds. These are the vendor’s first listed patches; the 2.90 prefix alone is insufficient.
| GS1900 model | Affected through | Vendor patch |
|---|---|---|
| 8 | 2.90(AAHH.1)C0 | 2.90(AAHH.2)C0 |
| 8HP | 2.90(AAHI.1)C0 | 2.90(AAHI.2)C0 |
| 10HP | 2.90(AAZI.1)C0 | 2.90(AAZI.2)C0 |
| 16 | 2.90(AAHJ.1)C0 | 2.90(AAHJ.2)C0 |
| 24 | 2.90(AAHL.1)C0 | 2.90(AAHL.2)C0 |
| 24E | 2.90(AAHK.1)C0 | 2.90(AAHK.2)C0 |
| 24EP | 2.90(ABTO.1)C0 | 2.90(ABTO.2)C0 |
| 24HPv2 | 2.90(ABTP.1)C0 | 2.90(ABTP.2)C0 |
| 48 | 2.90(AAHN.1)C0 | 2.90(AAHN.2)C0 |
| 48HPv2 | 2.90(ABTQ.1)C0 | 2.90(ABTQ.2)C0 |
Zyxel credits Lei Gu, Jun Cao, Zhiqing Rui, Jingzheng Wu and Tianyue Luo of ISCAS with reporting the vulnerability.
Restrict access and confirm builds
Move switch management onto a dedicated administrative VLAN or restrict the management interface with network ACLs so only designated admin hosts can reach it. This is Nulltap’s containment recommendation for the LAN-based HTTP path in CISA’s entry; a perimeter-only rule leaves internal clients able to reach the CGI program. Check the ACL from a regular client VLAN and an authorized admin host: the client should fail to connect to management while the admin host retains access.
Install the model-specific Zyxel patch through the vendor’s supported process, then read back the running firmware version and compare it with the matching table row. Evaluate internet exposure too, as CISA explicitly requires, while keeping the LAN path in view. For switches that might already have been accessed by an attacker, CISA calls for forensic triage in its KEV entry; preserve management and network evidence before resetting or replacing equipment.