CVE-2026-7273 (GCVE-0-2026-7273)
Vulnerability from cvelistv5 – Published: 2026-06-16 02:20 – Updated: 2026-09-22 03:55Summary
A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.
Severity
8.8 (High)
SSVC
Exploitation: active
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-17 00:00 UTC
CWE
- CWE-121 - Stack-based buffer overflow
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.zyxel.com/global/en/support/security-… | vendor-advisory |
| https://www.greynoise.io/blog/open-season-on-kapi… | third-party-advisory |
| https://www.cisa.gov/known-exploited-vulnerabilit… | government-resource |
Impacted products
10 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Zyxel | GS1900-48HPv2 firmware |
Affected:
<= 2.90(ABTQ.1)C0
|
guessed | |
| Zyxel | GS1900-8 firmware |
Affected:
<= 2.90(AAHH.1)C0
|
guessed | |
| Zyxel | GS1900-8HP firmware |
Affected:
<= 2.90(AAHI.1)C0
|
guessed | |
| Zyxel | GS1900-10HP firmware |
Affected:
<= 2.90(AAZI.1)C0
|
guessed | |
| Zyxel | GS1900-16 firmware |
Affected:
<= 2.90(AAHJ.1)C0
|
guessed | |
| Zyxel | GS1900-24 firmware |
Affected:
<= 2.90(AAHL.1)C0
|
guessed | |
| Zyxel | GS1900-24E firmware |
Affected:
<= 2.90(AAHK.1)C0
|
guessed | |
| Zyxel | GS1900-24EP firmware |
Affected:
<= 2.90(ABTO.1)C0
|
guessed | |
| Zyxel | GS1900-24HPv2 firmware |
Affected:
<= 2.90(ABTP.1)C0
|
guessed | |
| Zyxel | GS1900-48 firmware |
Affected:
<= 2.90(AAHN.1)C0
|
guessed |
CISA
Known Exploited Vulnerability - GCVE BCP-07 Compliant
KEV entry ID: ee44e786-843d-4fbb-8f62-7a9b25eef54e
Exploited: Yes
Timestamps
First Seen: 2026-09-21
Asserted: 2026-09-21
Scope
Notes: Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability | Affected: Zyxel / GS1900 Series Switches | Description: Zyxel GS1900 series switches contain a stack-based buffer overflow vulnerability in the CGI program which could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request. | Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. | Due date: 2026-09-24 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-stack-based-buffer-overflow-vulnerability-in-gs1900-series-switches-06-16-2026 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-7273
Evidence
Type: Vendor Report
Signal: Successful Exploitation
Confidence: 80%
Source: cisa-kev
Details
| Cwes | CWE-121 |
|---|---|
| Feed | CISA Known Exploited Vulnerabilities Catalog |
| Product | GS1900 Series Switches |
| Due Date | 2026-09-24 |
| Date Added | 2026-09-21 |
| Vendorproject | Zyxel |
| Vulnerabilityname | Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability |
| Knownransomwarecampaignuse | Unknown |
References
Created: 2026-09-21 20:00 UTC
| Updated: 2026-09-21 20:00 UTC
Previdian
Known Exploited Vulnerability - GCVE BCP-07 Compliant
KEV entry ID: 4d622737-cf24-43c3-a122-d3be1a7b99ad
Exploited: Yes
Timestamps
First Seen: 2026-09-21
Asserted: 2026-09-21
Scope
Notes: A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a... | Affected: Zyxel / GS1900-48HPv2 firmware, GS1900-8 firmware, GS1900-8HP firmware, GS1900-10HP firmware, GS1900-16 firmware, GS1900-24 firmware, GS1900-24E firmware, GS1900-24EP firmware, GS1900-24HPv2 firmware, GS1900-48 firmware | CVSS: 8.8 (HIGH) | EPSS: 0.00315 | Used in malware: unknown | Listed 6 hours ahead of CISA KEV | Not yet in CISA KEV: False
Evidence
Type: Public Report
Signal: Successful Exploitation
Confidence: 70%
Source: previdian
Details
| Feed | Previdian (previdian.com) |
|---|---|
| Title | A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a... |
| Cve Id | CVE-2026-7273 |
| Vendor | Zyxel |
| Ghsa Id | GHSA-RRV4-8JQ5-8J78 |
| Product | GS1900-48HPv2 firmware, GS1900-8 firmware, GS1900-8HP firmware, GS1900-10HP firmware, GS1900-16 firmware, GS1900-24 firmware, GS1900-24E firmware, GS1900-24EP firmware, GS1900-24HPv2 firmware, GS1900-48 firmware |
| Added Date | 2026-09-21T13:20:00.000Z |
| Cvss Score | 8.8 |
| Epss Score | 0.00315 |
| Previous Ids | |
| Cvss Severity | HIGH |
| Virtual Patch | False |
| Cvss Estimated | False |
| Epss Percentile | 0.24603 |
| Used In Malware | unknown |
| Vulnerability Id | CVE-2026-7273 |
| Ahead Of Cisa Kev |
|
| Not Yet In Cisa Kev | False |
References
Created: 2026-09-22 14:00 UTC
| Updated: 2026-09-22 14:00 UTC
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-7273",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-17T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2026-09-21",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-7273"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T03:55:39.207Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation"
},
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-7273"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-21T00:00:00.000Z",
"value": "CVE-2026-7273 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "GS1900-48HPv2 firmware",
"vendor": "Zyxel",
"versions": [
{
"status": "affected",
"version": "\u003c= 2.90(ABTQ.1)C0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "GS1900-8 firmware",
"vendor": "Zyxel",
"versions": [
{
"status": "affected",
"version": "\u003c= 2.90(AAHH.1)C0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "GS1900-8HP firmware",
"vendor": "Zyxel",
"versions": [
{
"status": "affected",
"version": "\u003c= 2.90(AAHI.1)C0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "GS1900-10HP firmware",
"vendor": "Zyxel",
"versions": [
{
"status": "affected",
"version": "\u003c= 2.90(AAZI.1)C0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "GS1900-16 firmware",
"vendor": "Zyxel",
"versions": [
{
"status": "affected",
"version": "\u003c= 2.90(AAHJ.1)C0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "GS1900-24 firmware",
"vendor": "Zyxel",
"versions": [
{
"status": "affected",
"version": "\u003c= 2.90(AAHL.1)C0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "GS1900-24E firmware",
"vendor": "Zyxel",
"versions": [
{
"status": "affected",
"version": "\u003c= 2.90(AAHK.1)C0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "GS1900-24EP firmware",
"vendor": "Zyxel",
"versions": [
{
"status": "affected",
"version": "\u003c= 2.90(ABTO.1)C0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "GS1900-24HPv2 firmware",
"vendor": "Zyxel",
"versions": [
{
"status": "affected",
"version": "\u003c= 2.90(ABTP.1)C0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "GS1900-48 firmware",
"vendor": "Zyxel",
"versions": [
{
"status": "affected",
"version": "\u003c= 2.90(AAHN.1)C0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through\u0026nbsp;2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request."
}
],
"value": "A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through\u00a02.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based buffer overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-16T02:20:29.847Z",
"orgId": "96e50032-ad0d-4058-a115-4d2c13821f9f",
"shortName": "Zyxel"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-stack-based-buffer-overflow-vulnerability-in-gs1900-series-switches-06-16-2026"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "96e50032-ad0d-4058-a115-4d2c13821f9f",
"assignerShortName": "Zyxel",
"cveId": "CVE-2026-7273",
"datePublished": "2026-06-16T02:20:29.847Z",
"dateReserved": "2026-04-28T06:21:36.574Z",
"dateUpdated": "2026-09-22T03:55:39.207Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-7273",
"date": "2026-09-22",
"epss": "0.01987",
"percentile": "0.7972"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "GS1900-48HPv2 firmware",
"vendor": "Zyxel",
"versions": [
{
"status": "affected",
"version": "\u003c= 2.90(ABTQ.1)C0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "GS1900-8 firmware",
"vendor": "Zyxel",
"versions": [
{
"status": "affected",
"version": "\u003c= 2.90(AAHH.1)C0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "GS1900-8HP firmware",
"vendor": "Zyxel",
"versions": [
{
"status": "affected",
"version": "\u003c= 2.90(AAHI.1)C0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "GS1900-10HP firmware",
"vendor": "Zyxel",
"versions": [
{
"status": "affected",
"version": "\u003c= 2.90(AAZI.1)C0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "GS1900-16 firmware",
"vendor": "Zyxel",
"versions": [
{
"status": "affected",
"version": "\u003c= 2.90(AAHJ.1)C0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "GS1900-24 firmware",
"vendor": "Zyxel",
"versions": [
{
"status": "affected",
"version": "\u003c= 2.90(AAHL.1)C0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "GS1900-24E firmware",
"vendor": "Zyxel",
"versions": [
{
"status": "affected",
"version": "\u003c= 2.90(AAHK.1)C0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "GS1900-24EP firmware",
"vendor": "Zyxel",
"versions": [
{
"status": "affected",
"version": "\u003c= 2.90(ABTO.1)C0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "GS1900-24HPv2 firmware",
"vendor": "Zyxel",
"versions": [
{
"status": "affected",
"version": "\u003c= 2.90(ABTP.1)C0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "GS1900-48 firmware",
"vendor": "Zyxel",
"versions": [
{
"status": "affected",
"version": "\u003c= 2.90(AAHN.1)C0"
}
]
}
],
"source": "security@zyxel.com.tw"
}
],
"cisaActionDue": "2026-09-24",
"cisaExploitAdd": "2026-09-21",
"cisaRequiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset\u0027s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"cisaVulnerabilityName": "Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability",
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:gs1900-8_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7C399F4A-32C4-4482-AC09-718473463836",
"versionEndExcluding": "2.90\\(aahh.2\\)c0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:gs1900-8:-:*:*:*:*:*:*:*",
"matchCriteriaId": "51D33F50-B5A4-4AEF-972C-7FF089C21D52",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:gs1900-8hp_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "428E979B-9FF5-4968-B399-5B8041B9C9C7",
"versionEndExcluding": "2.90\\(aahi.2\\)c0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:gs1900-8hp:-:*:*:*:*:*:*:*",
"matchCriteriaId": "27602862-EFB7-402B-994E-254A0B210820",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:gs1900-10hp_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D2189FCE-CD49-4FF0-91AF-18E4032A7A70",
"versionEndExcluding": "2.90\\(aazi.2\\)c0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:gs1900-10hp:-:*:*:*:*:*:*:*",
"matchCriteriaId": "89201505-07AF-4F9C-9304-46F2707DB9B4",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:gs1900-16_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1064772E-0A6C-48D0-B75F-F9B649C39CE5",
"versionEndExcluding": "2.90\\(aahj.2\\)c0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:gs1900-16:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5078F7A5-D03B-4D3A-9C19-57DFF4D6BF7A",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:gs1900-24_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "282A3334-6A1D-4758-B315-3AD75775A9F1",
"versionEndExcluding": "2.90\\(aahl.2\\)c0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:gs1900-24:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F4F55299-70D5-4CE1-A1EC-D79B469B94F7",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:gs1900-24e_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "3C91378D-4A01-48BD-8EA0-86FA4CA32186",
"versionEndExcluding": "2.90\\(aahk.2\\)c0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:gs1900-24e:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A6456AD6-8A1D-4D3D-AC1A-ABE442242B1B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:gs1900-24ep_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CC8623A8-D581-4DEB-AE4B-4865D8CC21FA",
"versionEndExcluding": "2.90\\(abto.2\\)c0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:gs1900-24ep:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B22AA8B1-11E2-408F-A1F6-0F8AF32AB131",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:gs1900-24hpv2_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "916252C6-288F-44E4-A029-0BE1C684D2E3",
"versionEndExcluding": "2.90\\(abtp.2\\)c0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:gs1900-24hpv2:-:*:*:*:*:*:*:*",
"matchCriteriaId": "512D9A91-8DA7-47F1-AC77-AF743F99BFF3",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:gs1900-48_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "74EEBA8C-D7F1-45BA-B81F-EFF85B69EFCF",
"versionEndExcluding": "2.90\\(aahn.2\\)c0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:gs1900-48:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CFB7D4BF-7D17-48D3-990D-4BADAC8BD868",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:gs1900-48hpv2_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "127498BB-7415-4AC9-BF12-318A9A11D467",
"versionEndExcluding": "2.90\\(abtq.2\\)c0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:gs1900-48hpv2:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BC74C679-6D22-47E4-AE8A-2647B1AA4276",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through\u00a02.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request."
}
],
"id": "CVE-2026-7273",
"lastModified": "2026-09-22T12:10:51.067",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "security@zyxel.com.tw",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-7273",
"options": [
{
"exploitation": "active"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-17T00:00:00+00:00",
"version": "2.0.3"
}
}
]
},
"published": "2026-06-16T03:16:13.557",
"references": [
{
"source": "security@zyxel.com.tw",
"tags": [
"Vendor Advisory"
],
"url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-stack-based-buffer-overflow-vulnerability-in-gs1900-series-switches-06-16-2026"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-7273"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation"
}
],
"sourceIdentifier": "security@zyxel.com.tw",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-121"
}
],
"source": "security@zyxel.com.tw",
"type": "Secondary"
}
]
}
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-7273",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T19:40:05.862596Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2026-09-21",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-7273"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-16T12:38:21.874Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation"
},
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-7273"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-21T00:00:00.000Z",
"value": "CVE-2026-7273 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "GS1900-48HPv2 firmware",
"vendor": "Zyxel",
"versions": [
{
"status": "affected",
"version": "\u003c= 2.90(ABTQ.1)C0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "GS1900-8 firmware",
"vendor": "Zyxel",
"versions": [
{
"status": "affected",
"version": "\u003c= 2.90(AAHH.1)C0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "GS1900-8HP firmware",
"vendor": "Zyxel",
"versions": [
{
"status": "affected",
"version": "\u003c= 2.90(AAHI.1)C0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "GS1900-10HP firmware",
"vendor": "Zyxel",
"versions": [
{
"status": "affected",
"version": "\u003c= 2.90(AAZI.1)C0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "GS1900-16 firmware",
"vendor": "Zyxel",
"versions": [
{
"status": "affected",
"version": "\u003c= 2.90(AAHJ.1)C0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "GS1900-24 firmware",
"vendor": "Zyxel",
"versions": [
{
"status": "affected",
"version": "\u003c= 2.90(AAHL.1)C0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "GS1900-24E firmware",
"vendor": "Zyxel",
"versions": [
{
"status": "affected",
"version": "\u003c= 2.90(AAHK.1)C0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "GS1900-24EP firmware",
"vendor": "Zyxel",
"versions": [
{
"status": "affected",
"version": "\u003c= 2.90(ABTO.1)C0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "GS1900-24HPv2 firmware",
"vendor": "Zyxel",
"versions": [
{
"status": "affected",
"version": "\u003c= 2.90(ABTP.1)C0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "GS1900-48 firmware",
"vendor": "Zyxel",
"versions": [
{
"status": "affected",
"version": "\u003c= 2.90(AAHN.1)C0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through\u0026nbsp;2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request."
}
],
"value": "A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through\u00a02.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based buffer overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-16T02:20:29.847Z",
"orgId": "96e50032-ad0d-4058-a115-4d2c13821f9f",
"shortName": "Zyxel"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-stack-based-buffer-overflow-vulnerability-in-gs1900-series-switches-06-16-2026"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "96e50032-ad0d-4058-a115-4d2c13821f9f",
"assignerShortName": "Zyxel",
"cveId": "CVE-2026-7273",
"datePublished": "2026-06-16T02:20:29.847Z",
"dateReserved": "2026-04-28T06:21:36.574Z",
"dateUpdated": "2026-09-22T03:55:39.207Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…