CISA adds critical Zyxel switch vulnerability to exploited flaws catalog
Unpatched GS1900 series switches vulnerable to LAN-based command execution attacks
1Critical vulnerability catalogued
CISA added CVE-2026-7273 to its Known Exploited Vulnerabilities list, a stack-based buffer overflow in Zyxel GS1900 switches with CVSS 8.8 severity. The flaw allows unauthenticated LAN attackers to execute OS commands via malicious HTTP requests. Affected devices include 8-port to 48-port models across multiple variants. Zyxel has released firmware patches for all impacted versions, with detailed version-specific remediation guidance.
2Attack mechanism
The vulnerability resides in the CGI component of Zyxel's switch firmware, where improper bounds checking enables buffer overflow. Attackers can craft HTTP requests to overwrite memory and gain command execution. This local network attack vector requires no authentication, making unpatched devices high-risk targets. The ISCAS research team discovered and reported the flaw, though active exploitation status remains unconfirmed by Zyxel.
3Federal remediation mandate
Under Binding Operational Directive 22-01, all federal agencies must patch affected Zyxel switches by September 24, 2026. CISA's catalog listing triggers mandatory remediation for government networks but doesn't disclose current exploitation details. Private organizations are strongly advised to prioritize this vulnerability given its critical rating and potential for network compromise without authentication requirements.
4Affected device models
The vulnerability impacts multiple GS1900 series switches including 8HP, 10HP, 16, 24, 24E, 24EP, 24HPv2, 48, and 48HPv2 models. Each variant has specific affected firmware versions and corresponding patches. For example, GS1900-8 switches running 2.90(AAHH.1)C0 or earlier require upgrade to 2.90(AAHH.2)C0. Zyxel maintains a comprehensive patching matrix covering all vulnerable configurations.
5Technical severity assessment
With CVSS 8.8 (High severity), this vulnerability combines network accessibility with critical impact potential. The buffer overflow enables arbitrary command execution at OS level, offering attackers complete device control. Unlike vulnerabilities requiring authentication, this flaw's LAN-based, unauthenticated nature significantly lowers the attack barrier. The CGI component's exposure to HTTP requests creates a broad attack surface.
6Enterprise security implications
Organizations using Zyxel GS1900 switches face substantial risk until patching completes. The switches' network infrastructure role means compromise could enable lateral movement. Security teams should prioritize inventory checks, verify patch levels, and monitor for suspicious HTTP traffic. While federal agencies have a fixed deadline, private enterprises should treat this as urgent given exploit potential and catalog listing.
7Vulnerability management context
CISA's KEV catalog focuses on vulnerabilities with known active exploitation or high likelihood of weaponization. Inclusion signals immediate action required, especially for network devices. This marks another critical infrastructure vulnerability following recent focus on network equipment security. The catalog mechanism helps standardize response timelines across government entities.
8Proactive defense recommendations
Beyond patching, network segmentation can limit exploit impact by restricting LAN access to switches. Monitoring for anomalous HTTP requests to switch management interfaces may detect exploitation attempts. Organizations should review all network device firmware against CISA's catalog, not just Zyxel products. This case underscores the importance of timely updates for network infrastructure components.