{"id":"zyxel-gs1900-switch-attacks-jun-2026","category":"patch","status":"closed","title":"Zyxel GS1900 switches: CVE-2026-7273 exploited for data theft; firmware fixes available","tldr":"Attackers have used CVE-2026-7273 to steal data from Zyxel GS1900 network switches. Zyxel describes a local-network attack without a login. Fixes cover all ten listed models: ask your network installer to update the exact model's firmware.","summary":"CVE-2026-7273 is a memory-handling flaw in the web-management software of Zyxel GS1900 network switches. Zyxel says an attacker on the local network could use it to run operating-system commands without logging in; it does not describe unrestricted access from anywhere on the internet. Zyxel disclosed the flaw and released model-specific firmware fixes on 16 June for all ten affected supported models. CISA confirmed exploitation through its 21 September catalogue listing. Reports citing GreyNoise describe stolen configurations, hashed administrator credentials and network information from 996 switches in 48 countries, including 564 with factory-default credentials. Reports differ on timing: SecurityWeek places attacks in August, while BleepingComputer describes first signs on 17 September. As of 3 November, no later patch revision or public confirmation that the attacks had ended was found.","action":"If your home or office uses a Zyxel GS1900 switch, ask your network installer or IT provider to install the firmware listed below for its exact model, or a newer release. Ask them to check for compromise and replace any factory-default administrator password, since attackers have stolen switch configurations and credential hashes.","product":"Zyxel GS1900 series network switches","audience":"both","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2026-7273"],"tags":["zyxel","gs1900","network-switch","firmware","actively-exploited","data-theft"],"affected":["GS1900-8: 2.90(AAHH.1)C0 and earlier","GS1900-8HP: 2.90(AAHI.1)C0 and earlier","GS1900-10HP: 2.90(AAZI.1)C0 and earlier","GS1900-16: 2.90(AAHJ.1)C0 and earlier","GS1900-24: 2.90(AAHL.1)C0 and earlier","GS1900-24E: 2.90(AAHK.1)C0 and earlier","GS1900-24EP: 2.90(ABTO.1)C0 and earlier","GS1900-24HPv2: 2.90(ABTP.1)C0 and earlier","GS1900-48: 2.90(AAHN.1)C0 and earlier","GS1900-48HPv2: 2.90(ABTQ.1)C0 and earlier"],"fixed":["GS1900-8: 2.90(AAHH.2)C0","GS1900-8HP: 2.90(AAHI.2)C0","GS1900-10HP: 2.90(AAZI.2)C0","GS1900-16: 2.90(AAHJ.2)C0","GS1900-24: 2.90(AAHL.2)C0","GS1900-24E: 2.90(AAHK.2)C0","GS1900-24EP: 2.90(ABTO.2)C0","GS1900-24HPv2: 2.90(ABTP.2)C0","GS1900-48: 2.90(AAHN.2)C0","GS1900-48HPv2: 2.90(ABTQ.2)C0"],"matches":[{"platform":"other","app":"Zyxel GS1900-8","bundle":"","fixed":"2.90(AAHH.2)C0"},{"platform":"other","app":"Zyxel GS1900-8HP","bundle":"","fixed":"2.90(AAHI.2)C0"},{"platform":"other","app":"Zyxel GS1900-10HP","bundle":"","fixed":"2.90(AAZI.2)C0"},{"platform":"other","app":"Zyxel GS1900-16","bundle":"","fixed":"2.90(AAHJ.2)C0"},{"platform":"other","app":"Zyxel GS1900-24","bundle":"","fixed":"2.90(AAHL.2)C0"},{"platform":"other","app":"Zyxel GS1900-24E","bundle":"","fixed":"2.90(AAHK.2)C0"},{"platform":"other","app":"Zyxel GS1900-24EP","bundle":"","fixed":"2.90(ABTO.2)C0"},{"platform":"other","app":"Zyxel GS1900-24HPv2","bundle":"","fixed":"2.90(ABTP.2)C0"},{"platform":"other","app":"Zyxel GS1900-48","bundle":"","fixed":"2.90(AAHN.2)C0"},{"platform":"other","app":"Zyxel GS1900-48HPv2","bundle":"","fixed":"2.90(ABTQ.2)C0"}],"sources":[{"kind":"advisory","title":"Zyxel security advisory for stack-based buffer overflow vulnerability in GS1900 series switches","url":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-stack-based-buffer-overflow-vulnerability-in-gs1900-series-switches-06-16-2026","by":"Zyxel","date":"2026-06-16"},{"kind":"advisory","title":"Zyxel security advisory (AV26-603) – Update 1","url":"https://www.cyber.gc.ca/en/alerts-advisories/zyxel-security-advisory-av26-603","by":"Canadian Centre for Cyber Security","date":"2026-09-21"},{"kind":"news","title":"Recent ZyXEL Switch Vulnerability Exploited by Chinese Hackers","url":"https://www.securityweek.com/recent-zyxel-switch-vulnerability-exploited-by-chinese-hackers/","by":"SecurityWeek","date":"2026-09-22"},{"kind":"news","title":"CISA orders feds to patch Zyxel flaw exploited for data theft","url":"https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-actively-exploited-zyxel-flaw-by-thursday/","by":"BleepingComputer","date":"2026-09-22"},{"kind":"advisory","title":"CVE-2026-7273 Detail","url":"https://nvd.nist.gov/vuln/detail/cve-2026-7273","by":"NIST National Vulnerability Database","date":"2026-10-25"}],"started":"2026-09-21","closed":"2026-09-22","created":"2026-11-03T22:02:45.595Z","updated":"2026-11-03T22:02:45.595Z","cve_notes":[{"cve":"CVE-2026-7273","name":"Stack buffer overflow in Zyxel GS1900 web management","what":"A stack-based buffer overflow in the switches' CGI web-management program could let an attacker on the local network run operating-system commands without logging in.","severity":"high","cvss":8.8}],"timeline":[{"at":"2026-09-22","added":"2026-11-03T22:00:26.134Z","kind":"wider-attacks","text":"SecurityWeek reported GreyNoise's finding that attackers stole configurations, hashed administrator credentials and network information from 996 switches across 48 countries in August. Of those devices, 564 still had factory-default credentials.","url":"https://www.securityweek.com/recent-zyxel-switch-vulnerability-exploited-by-chinese-hackers/","by":"SecurityWeek","patch":null},{"at":"2026-09-21","added":"2026-11-03T22:00:26.134Z","kind":"cisa-added","text":"CISA added CVE-2026-7273 to its Known Exploited Vulnerabilities catalogue. Canada's Cyber Centre updated its advisory to highlight the listing and urge users to apply updates.","url":"https://www.cyber.gc.ca/en/alerts-advisories/zyxel-security-advisory-av26-603","by":"Canadian Centre for Cyber Security","patch":null},{"at":"2026-06-16","added":"2026-11-03T22:00:26.134Z","kind":"disclosed","text":"Zyxel disclosed CVE-2026-7273 and released firmware fixes for ten GS1900 switch models. The flaw could let an attacker on the local network run operating-system commands without logging in.","url":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-stack-based-buffer-overflow-vulnerability-in-gs1900-series-switches-06-16-2026","by":"Zyxel","patch":"patched"}],"url":"https://hard.fyi/live/zyxel-gs1900-switch-attacks-jun-2026/","json":"https://hard.fyi/api/live?id=zyxel-gs1900-switch-attacks-jun-2026"}