Loading story…
Zyxel has released firmware updates for CVE-2026-7273, a stack-based buffer overflow in the CGI component of GS1900 series switch firmware that can let a LAN-based, unauthenticated attacker send a crafted HTTP request and potentially execute operating system commands on affected devices. The flaw carries a CVSS 8.8 rating and is classified as CWE-121, with impact to confidentiality, integrity, and availability; public references specifically note exposure in models across the GS1900 line, including devices such as the GS1900-8, GS1900-24, GS1900-48HPv2, and other units running firmware 2.90 or earlier in their respective branches.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
On June 16, 2026, Zyxel published a security advisory for CVE-2026-7273 affecting GS1900 series switches and released updated firmware for supported models. Zyxel said products not listed are unaffected and urged customers to install the patched versions.
CVE-2026-7273, a stack-based buffer overflow in the CGI program of GS1900 series switch firmware, was reported to Zyxel. The flaw could let a LAN-based unauthenticated attacker send a crafted HTTP request and potentially execute OS commands.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcecyber.gc.ca
Open sourcecvefeed.io
Open sourcezyxel.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA added **CVE-2026-7273** to its Known Exploited Vulnerabilities catalog after confirming active exploitation of a critical stack-based buffer overflow in Zyxel GS1900 Series Switches. The flaw resides in the switches' CGI program and allows an unauthenticated attacker on the local network to send a crafted HTTP request and potentially execute operating-system commands. Federal agencies must remediate the issue by **September 24, 2026**, under Binding Operational Directive 26-04; CISA also requires forensic triage. Organizations should apply Zyxel's mitigations, restrict switch-management interfaces to trusted administrative networks, assess exposed devices, and review switches and logs for compromise indicators. Organizations unable to mitigate the vulnerability should discontinue use of affected devices; ransomware-campaign use is currently unknown.
Sep 22, 2026
Zyxel has disclosed and patched **CVE-2026-6952**, a post-authentication command injection flaw affecting certain **DSL/Ethernet CPE devices, Fiber ONTs, and Wireless Extenders** across multiple models and firmware versions. The vulnerability resides in the `LogServer` field of the syslog component and could let an authenticated attacker with administrator privileges execute operating system commands on an affected device. The Canadian Centre for Cyber Security issued alert **AV26-725** urging organizations, service providers, and users to review Zyxel’s advisory and apply the relevant firmware updates. Zyxel said WAN access is disabled by default and that exploitation requires valid or compromised user-configured credentials, and it published fixed firmware versions for affected products while crediting researcher **William Honnér** for reporting the issue.
Jul 21, 2026
Zyxel's **WAH7601** portable 4G router is affected by a set of four vulnerabilities, including the critical unauthenticated OS command injection flaw **`CVE-2026-13206`** and the high-severity credential exposure issue **`CVE-2026-12984`**. According to TR-CERT advisory **`TR-26-0799`**, all four flaws affect firmware through build **`20072026`**. The command injection bug is remotely exploitable and carries a **CVSS 9.8** score, while the credential issue, scored **CVSS 8.2**, can allow unauthorized retrieval of embedded sensitive data. The reported impact includes **root-level remote code execution**, credential theft, traffic interception, persistence on the device, and possible pivoting into internal networks after compromise. Public reporting said no active exploitation had been observed, but also noted that the vulnerabilities were **unpatched** at disclosure time. Recommended defenses include updating to the latest firmware if available, applying any vendor fixes, restricting or removing internet exposure of the management interface, strengthening access credentials, and replacing the device if access cannot be adequately controlled.
Aug 11, 2026