DEV Community

kozhevniko
kozhevniko

Posted on

What an attacker gains from CVE-2026-7273 on a Zyxel GS1900 switch

#cybersecurity #infosec #networking #security

What an attacker gains from CVE-2026-7273 on a Zyxel GS1900 switch

CVE-2026-7273 lets an unauthenticated attacker on the local network run OS commands on a Zyxel GS1900 switch. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 21 September 2026, which means the exploitation is not theoretical. Understanding what the attacker gets after the overflow explains why a switch bug receives the same urgency as a server bug, and it also shapes what defenders should check.

The entry point

The vulnerable component is the CGI program behind the switch's web management interface. A crafted HTTP request overflows a stack buffer, and the overwrite can be used to redirect execution into attacker-controlled data. Zyxel classifies the weakness as CWE-121 and scores it 8.8 with the vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The attacker needs a network position adjacent to the switch, and nothing else.

Why a switch is a valuable target

A switch is a position, not just a device. From the control plane of a switch, an attacker can:

  • Read and modify VLAN definitions, which changes which systems can talk to which.
  • Change port configurations, including mirroring traffic to a port the attacker controls.
  • Read the running configuration, which often contains management credentials reused on other devices.
  • Add static routes or alter forwarding so that traffic takes a path through infrastructure the attacker can observe.
  • Pivot to every segment the switch routes or bridges, without needing credentials for those segments. On a network where the switch is the only device enforcing separation between user, server, and management traffic, command execution on that switch removes the separation.

Persistence and detection

An attacker with command execution can create a local account, change SNMP communities, or alter the configuration so the change looks intentional. These modifications survive a reboot if they are written to the startup configuration, and they are easy to miss because switch configuration is rarely reviewed line by line.
Detection therefore depends on comparison rather than on a single indicator. Keep a known-good configuration backup and diff against it. Watch for new accounts, changed SNMP strings, altered VLAN membership, and static routes that no administrator added. Review logs for POST requests to the web interface's CGI endpoints with unusually long parameters, since the overflow is triggered by a crafted HTTP request.

Which devices are affected

Model Affected version Patch
GS1900-8 2.90(AAHH.1)C0 and earlier 2.90(AAHH.2)C0
GS1900-8HP 2.90(AAHI.1)C0 and earlier 2.90(AAHI.2)C0
GS1900-10HP 2.90(AAZI.1)C0 and earlier 2.90(AAZI.2)C0
GS1900-16 2.90(AAHJ.1)C0 and earlier 2.90(AAHJ.2)C0
GS1900-24 2.90(AAHL.1)C0 and earlier 2.90(AAHL.2)C0
GS1900-24E 2.90(AAHK.1)C0 and earlier 2.90(AAHK.2)C0
GS1900-24EP 2.90(ABTO.1)C0 and earlier 2.90(ABTO.2)C0
GS1900-24HPv2 2.90(ABTP.1)C0 and earlier 2.90(ABTP.2)C0
GS1900-48 2.90(AAHN.1)C0 and earlier 2.90(AAHN.2)C0
GS1900-48HPv2 2.90(ABTQ.1)C0 and earlier 2.90(ABTQ.2)C0

Zyxel reports that on-market products outside this list are unaffected. The NVD record is marked Deferred, so the vendor table is the reference for version ranges.

Where the devices are

ZoomEye returns 5,920 matches for app="Zyxel" && title="GS1900", identifying Zyxel devices whose HTML title contains the GS1900 family name. The figure counts fingerprint matches and does not confirm vulnerable firmware or reachability. A CVE-scoped query, vul.cve="CVE-2026-7273", returned no indexed assets.
For an attacker, the interesting subset is switches whose management interface answers from a segment that also carries ordinary user devices. That is a local question, and it is the one to answer first.

Closing the position

Update the affected models to the fixed firmware listed above. Zyxel's advisory links the downloads.
Until the update is applied, remove the path to the CGI interface. Move management to a dedicated out-of-band network, disable remote management on reachable interfaces, and block client and guest segments from routing to the switch's web interface. These measures do not fix the overflow, but they take away the network position the exploit requires.
Then run the triage the KEV entry requires. Compare configurations against a known-good baseline, look for accounts and settings that nobody added, and treat any switch that was reachable from an untrusted segment as a possible entry point rather than a device that only needs a patch.

References

Top comments (0)