CVE-2026-7273

Published: Jun 16, 2026Modified: Oct 25, 2026CISA KEV

8.8

Vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: security@zyxel.com.tw (Secondary)

Description

A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.

Affected (10)

Products: Zyxel: Gs1900 8 Firmware, Gs1900 8hp Firmware, Gs1900 10hp Firmware, Gs1900 16 Firmware, Gs1900 24 Firmware, Gs1900 24e Firmware, Gs1900 24ep Firmware, Gs1900 24hpv2 Firmware, Gs1900 48 Firmware, Gs1900 48hpv2 Firmware

10 products

Gs1900 24hpv2 Firmware

Gs1900 48 Firmware

Gs1900 48hpv2 Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Gs1900 8 Firmware	version < 2.90\(aahh.2\)c0

Running on/with	Platform Versions
Zyxel Gs1900 8	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Gs1900 8hp Firmware	version < 2.90\(aahi.2\)c0

Running on/with	Platform Versions
Zyxel Gs1900 8hp	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Gs1900 10hp Firmware	version < 2.90\(aazi.2\)c0

Running on/with	Platform Versions
Zyxel Gs1900 10hp	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Gs1900 16 Firmware	version < 2.90\(aahj.2\)c0

Running on/with	Platform Versions
Zyxel Gs1900 16	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Gs1900 24 Firmware	version < 2.90\(aahl.2\)c0

Running on/with	Platform Versions
Zyxel Gs1900 24	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Gs1900 24e Firmware	version < 2.90\(aahk.2\)c0

Running on/with	Platform Versions
Zyxel Gs1900 24e	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Gs1900 24ep Firmware	version < 2.90\(abto.2\)c0

Running on/with	Platform Versions
Zyxel Gs1900 24ep	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Gs1900 24hpv2 Firmware	version < 2.90\(abtp.2\)c0

Running on/with	Platform Versions
Zyxel Gs1900 24hpv2	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Gs1900 48 Firmware	version < 2.90\(aahn.2\)c0

Running on/with	Platform Versions
Zyxel Gs1900 48	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Gs1900 48hpv2 Firmware	version < 2.90\(abtq.2\)c0

Running on/with	Platform Versions
Zyxel Gs1900 48hpv2	All versions

Related CWEs

CWE-121

Stack-based Buffer Overflow

A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

References (3)

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-stack-based-buffer-overflow-vulnerability-in-gs1900-series-switches-06-16-2026

Source: security@zyxel.com.tw

Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-7273

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Third Party AdvisoryUS Government Resource

https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitThird Party Advisory

Timeline

No history available yet.