CVE-2026-7273
Full vulnerability record from the local CVENow database.
Description
A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.
Severity
HIGH
CVSS score
8.8
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2026-06-16 03:16:13.557000
Last modified
2026-10-25 23:10:00.167000
View original CVE JSON
{
"id": "CVE-2026-7273",
"sourceIdentifier": "[email protected]",
"published": "2026-06-16T03:16:13.557",
"lastModified": "2026-10-25T23:10:00.167",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request."
},
{
"lang": "es",
"value": "Una vulnerabilidad de desbordamiento de búfer basado en pila en el programa CGI de las versiones de firmware Zyxel GS1900-48HPv2 hasta la 2.90(ABTQ.1)C0 podría permitir a un atacante no autenticado, basado en la LAN, explotar la falla y potencialmente ejecutar comandos del sistema operativo a través de una solicitud HTTP manipulada."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Zyxel",
"product": "GS1900-48HPv2 firmware",
"defaultStatus": "unaffected",
"versions": [
{
"version": "<= 2.90(ABTQ.1)C0",
"status": "affected"
}
]
},
{
"vendor": "Zyxel",
"product": "GS1900-8 firmware",
"defaultStatus": "unaffected",
"versions": [
{
"version": "<= 2.90(AAHH.1)C0",
"status": "affected"
}
]
},
{
"vendor": "Zyxel",
"product": "GS1900-8HP firmware",
"defaultStatus": "unaffected",
"versions": [
{
"version": "<= 2.90(AAHI.1)C0",
"status": "affected"
}
]
},
{
"vendor": "Zyxel",
"product": "GS1900-10HP firmware",
"defaultStatus": "unaffected",
"versions": [
{
"version": "<= 2.90(AAZI.1)C0",
"status": "affected"
}
]
},
{
"vendor": "Zyxel",
"product": "GS1900-16 firmware",
"defaultStatus": "unaffected",
"versions": [
{
"version": "<= 2.90(AAHJ.1)C0",
"status": "affected"
}
]
},
{
"vendor": "Zyxel",
"product": "GS1900-24 firmware",
"defaultStatus": "unaffected",
"versions": [
{
"version": "<= 2.90(AAHL.1)C0",
"status": "affected"
}
]
},
{
"vendor": "Zyxel",
"product": "GS1900-24E firmware",
"defaultStatus": "unaffected",
"versions": [
{
"version": "<= 2.90(AAHK.1)C0",
"status": "affected"
}
]
},
{
"vendor": "Zyxel",
"product": "GS1900-24EP firmware",
"defaultStatus": "unaffected",
"versions": [
{
"version": "<= 2.90(ABTO.1)C0",
"status": "affected"
}
]
},
{
"vendor": "Zyxel",
"product": "GS1900-24HPv2 firmware",
"defaultStatus": "unaffected",
"versions": [
{
"version": "<= 2.90(ABTP.1)C0",
"status": "affected"
}
]
},
{
"vendor": "Zyxel",
"product": "GS1900-48 firmware",
"defaultStatus": "unaffected",
"versions": [
{
"version": "<= 2.90(AAHN.1)C0",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-06-17T00:00:00+00:00",
"id": "CVE-2026-7273",
"options": [
{
"exploitation": "active"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"cisaExploitAdd": "2026-09-21",
"cisaActionDue": "2026-09-24",
"cisaRequiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"cisaVulnerabilityName": "Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability",
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-121"
}
]
}
],
"configurations": [
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:zyxel:gs1900-8_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.90\\(aahh.2\\)c0",
"matchCriteriaId": "7C399F4A-32C4-4482-AC09-718473463836"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:h:zyxel:gs1900-8:-:*:*:*:*:*:*:*",
"matchCriteriaId": "51D33F50-B5A4-4AEF-972C-7FF089C21D52"
}
]
}
]
},
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:zyxel:gs1900-8hp_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.90\\(aahi.2\\)c0",
"matchCriteriaId": "428E979B-9FF5-4968-B399-5B8041B9C9C7"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:h:zyxel:gs1900-8hp:-:*:*:*:*:*:*:*",
"matchCriteriaId": "27602862-EFB7-402B-994E-254A0B210820"
}
]
}
]
},
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:zyxel:gs1900-10hp_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.90\\(aazi.2\\)c0",
"matchCriteriaId": "D2189FCE-CD49-4FF0-91AF-18E4032A7A70"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:h:zyxel:gs1900-10hp:-:*:*:*:*:*:*:*",
"matchCriteriaId": "89201505-07AF-4F9C-9304-46F2707DB9B4"
}
]
}
]
},
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:zyxel:gs1900-16_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.90\\(aahj.2\\)c0",
"matchCriteriaId": "1064772E-0A6C-48D0-B75F-F9B649C39CE5"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:h:zyxel:gs1900-16:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5078F7A5-D03B-4D3A-9C19-57DFF4D6BF7A"
}
]
}
]
},
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:zyxel:gs1900-24_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.90\\(aahl.2\\)c0",
"matchCriteriaId": "282A3334-6A1D-4758-B315-3AD75775A9F1"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:h:zyxel:gs1900-24:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F4F55299-70D5-4CE1-A1EC-D79B469B94F7"
}
]
}
]
},
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:zyxel:gs1900-24e_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.90\\(aahk.2\\)c0",
"matchCriteriaId": "3C91378D-4A01-48BD-8EA0-86FA4CA32186"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:h:zyxel:gs1900-24e:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A6456AD6-8A1D-4D3D-AC1A-ABE442242B1B"
}
]
}
]
},
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:zyxel:gs1900-24ep_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.90\\(abto.2\\)c0",
"matchCriteriaId": "CC8623A8-D581-4DEB-AE4B-4865D8CC21FA"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:h:zyxel:gs1900-24ep:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B22AA8B1-11E2-408F-A1F6-0F8AF32AB131"
}
]
}
]
},
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:zyxel:gs1900-24hpv2_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.90\\(abtp.2\\)c0",
"matchCriteriaId": "916252C6-288F-44E4-A029-0BE1C684D2E3"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:h:zyxel:gs1900-24hpv2:-:*:*:*:*:*:*:*",
"matchCriteriaId": "512D9A91-8DA7-47F1-AC77-AF743F99BFF3"
}
]
}
]
},
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:zyxel:gs1900-48_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.90\\(aahn.2\\)c0",
"matchCriteriaId": "74EEBA8C-D7F1-45BA-B81F-EFF85B69EFCF"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:h:zyxel:gs1900-48:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CFB7D4BF-7D17-48D3-990D-4BADAC8BD868"
}
]
}
]
},
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:zyxel:gs1900-48hpv2_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.90\\(abtq.2\\)c0",
"matchCriteriaId": "127498BB-7415-4AC9-BF12-318A9A11D467"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:h:zyxel:gs1900-48hpv2:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BC74C679-6D22-47E4-AE8A-2647B1AA4276"
}
]
}
]
}
],
"references": [
{
"url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-stack-based-buffer-overflow-vulnerability-in-gs1900-series-switches-06-16-2026",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-7273",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"Third Party Advisory",
"US Government Resource"
]
},
{
"url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"Exploit",
"Third Party Advisory"
]
}
]
}