DaystoPatch

ZyxelExploited incident

Zyxel GS1900 series switches CGI stack-based buffer overflow

CVE-2026-7273High, CVSS 8.8In CISA's Known Exploited Vulnerabilities catalog since 21 Sep 2026

  • Exploited after a fix existed
FixedFixed for every supported version on the day it became public.

Response

Silence
same day
First public report to first vendor statement
Exposure
same day
First public report to first fix
Follow-through
same day
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    date only

    Zyxel security advisory (GS1900 stack-based buffer overflow, 06-16-2026)CuratedQuote verified

    Revision history 2026-6-16: Initial release

    Privately reported by ISCAS researchers; the vendor advisory with fixes was the first public signal. Exploitation was reported later (GreyNoise, September 2026).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:de859e2a0cfa1f8b…
    Used in metrics
    Yes
    Dispute this timestamp
    5 more sources for this moment
    CVE.org record CVE-2026-7273ClaimedQuote verified16 Jun 2026, 02:20 UTC

    A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:6055016f7eb64c90…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet16 Jun 2026, 04:02 UTC

    CVE-2026-7273 - Zyxel GS1900-48HPv2 Stack-Based Buffer Overflow Remote Code Execution

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2026-7273)ClaimedQuote verified21 Sep 2026

    Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability

    Added to CISA's KEV catalog on 2026-09-21.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet21 Sep 2026, 21:00 UTC

    🚨 [CISA-2026:0921] CISA Adds One Known Exploited Vulnerability to Catalog ( https:// secdb.nttzen.cloud/security-ad visory/detail/CISA-2026:0921 ) CISA has added one new vulnerability to its Known

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Help Net SecurityCuratedQuote verified22 Sep 2026

    The attacks exploiting CVE-2026-7273 happened on or about 17 August, GreyNoise said, and the threat actor grabbed compromised devices’ configuration, networking information, and hashed root level credentials.

    First exploitation report found (GreyNoise via Help Net Security, 2026-09-22). Later than the advisory, so it does not change the world moment; recorded to document that exploitation began after the fix. BleepingComputer's report reportedly gives a different first-seen date (September); not resolved.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:f0f10459ea0e2c49…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    same day

    CVE record CVE-2026-7273 (Zyxel as CNA)CuratedQuote verified

    "assignerShortName":"Zyxel","dateReserved":"2026-04-28T06:21:36.574Z","datePublished":"2026-06-16T02:20:29.847Z"

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:6055016f7eb64c90…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    Zyxel security advisory (GS1900 stack-based buffer overflow, 06-16-2026)CuratedQuote verified16 Jun 2026

    Revision history 2026-6-16: Initial release

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:de859e2a0cfa1f8b…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    date onlysame day

    Zyxel security advisory, Wayback snapshot 2026-06-16 13:46 UTCCuratedQuote verified

    Zyxel has released patches for GS1900 series switches affected by a stack-based buffer overflow vulnerability.

    Patches were listed in the initial release (revision history: 2026-6-16 Initial release; earliest Wayback snapshot 20260616134610 already shows the patch table).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:e5f87c60a55ca162…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    date onlysame day

    Zyxel security advisory, Wayback snapshot 2026-06-16 13:46 UTCCuratedQuote verified

    we identified the vulnerable switch firmware versions and released patches for models still within their vulnerability support period, as shown in the table below.

    All ten listed GS1900 models had a fixed 2.90(xxxx.2)C0 firmware at initial release. Models past Zyxel's vulnerability support period are not listed and are not counted.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:e5f87c60a55ca162…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.

Affected products

  • Zyxel GS1900 series switches (GS1900-8, -8HP, -10HP, -16, -24, -24E, -24EP, -24HPv2, -48, -48HPv2)
How we built this timeline

Coordinated disclosure: fixed firmware shipped with the advisory on 16 Jun 2026; exploitation (GreyNoise: 996 switches, on or about 17 August 2026 per Help Net Security) began after the fix, so exploited before a fix is false. Severity/CVSS are Zyxel's CNA CVSS 3.1 score (8.8, AV:A).

The live advisory fetched 22 Oct 2026 still shows a single 'Initial release' revision and does not mention exploitation. The attacker needs LAN (adjacent network) access to the switch web interface.

Related

No related incidents.

Zyxel report card