Zyxel GS1900 switches: CVE-2026-7273 exploited for data theft; firmware fixes available
Attackers have used CVE-2026-7273 to steal data from Zyxel GS1900 network switches. Zyxel describes a local-network attack without a login. Fixes cover all ten listed models: ask your network installer to update the exact model's firmware.
If your home or office uses a Zyxel GS1900 switch, ask your network installer or IT provider to install the firmware listed below for its exact model, or a newer release. Ask them to check for compromise and replace any factory-default administrator password, since attackers have stolen switch configurations and credential hashes.
- Zyxel GS1900-8fixed in 2.90(AAHH.2)C0 and later
- Zyxel GS1900-8HPfixed in 2.90(AAHI.2)C0 and later
- Zyxel GS1900-10HPfixed in 2.90(AAZI.2)C0 and later
- Zyxel GS1900-16fixed in 2.90(AAHJ.2)C0 and later
- Zyxel GS1900-24fixed in 2.90(AAHL.2)C0 and later
- Zyxel GS1900-24Efixed in 2.90(AAHK.2)C0 and later
- Zyxel GS1900-24EPfixed in 2.90(ABTO.2)C0 and later
- Zyxel GS1900-24HPv2fixed in 2.90(ABTP.2)C0 and later
- Zyxel GS1900-48fixed in 2.90(AAHN.2)C0 and later
- Zyxel GS1900-48HPv2fixed in 2.90(ABTQ.2)C0 and later
What’s happening
CVE-2026-7273 is a memory-handling flaw in the web-management software of Zyxel GS1900 network switches. Zyxel says an attacker on the local network could use it to run operating-system commands without logging in; it does not describe unrestricted access from anywhere on the internet. Zyxel disclosed the flaw and released model-specific firmware fixes on 16 June for all ten affected supported models. CISA confirmed exploitation through its 21 September catalogue listing. Reports citing GreyNoise describe stolen configurations, hashed administrator credentials and network information from 996 switches in 48 countries, including 564 with factory-default credentials. Reports differ on timing: SecurityWeek places attacks in August, while BleepingComputer describes first signs on 17 September. As of 3 November, no later patch revision or public confirmation that the attacks had ended was found.
- What
- Flaw
- Affects
- Zyxel GS1900 series network switches
- Affected
- GS1900-8: 2.90(AAHH.1)C0 and earlier
GS1900-8HP: 2.90(AAHI.1)C0 and earlier
GS1900-10HP: 2.90(AAZI.1)C0 and earlier
GS1900-16: 2.90(AAHJ.1)C0 and earlier
GS1900-24: 2.90(AAHL.1)C0 and earlier
GS1900-24E: 2.90(AAHK.1)C0 and earlier
GS1900-24EP: 2.90(ABTO.1)C0 and earlier
GS1900-24HPv2: 2.90(ABTP.1)C0 and earlier
GS1900-48: 2.90(AAHN.1)C0 and earlier
GS1900-48HPv2: 2.90(ABTQ.1)C0 and earlier - Fixed in
- GS1900-8: 2.90(AAHH.2)C0
GS1900-8HP: 2.90(AAHI.2)C0
GS1900-10HP: 2.90(AAZI.2)C0
GS1900-16: 2.90(AAHJ.2)C0
GS1900-24: 2.90(AAHL.2)C0
GS1900-24E: 2.90(AAHK.2)C0
GS1900-24EP: 2.90(ABTO.2)C0
GS1900-24HPv2: 2.90(ABTP.2)C0
GS1900-48: 2.90(AAHN.2)C0
GS1900-48HPv2: 2.90(ABTQ.2)C0 - Since
- 21 Sept 2026
- Closed
- 22 Sept 2026
Timeline
- Wider attacks
SecurityWeek reported GreyNoise's finding that attackers stole configurations, hashed administrator credentials and network information from 996 switches across 48 countries in August. Of those devices, 564 still had factory-default credentials.
- CISA added
CISA added CVE-2026-7273 to its Known Exploited Vulnerabilities catalogue. Canada's Cyber Centre updated its advisory to highlight the listing and urge users to apply updates.
- Made publicFixed
Zyxel disclosed CVE-2026-7273 and released firmware fixes for ten GS1900 switch models. The flaw could let an attacker on the local network run operating-system commands without logging in.
Sources
- Zyxel security advisory for stack-based buffer overflow vulnerability in GS1900 series switchesZyxel · 16 June 2026
- Zyxel security advisory (AV26-603) – Update 1Canadian Centre for Cyber Security · 21 Sept 2026
- Recent ZyXEL Switch Vulnerability Exploited by Chinese HackersSecurityWeek · 22 Sept 2026
- CISA orders feds to patch Zyxel flaw exploited for data theftBleepingComputer · 22 Sept 2026
- CVE-2026-7273 DetailNIST National Vulnerability Database · 25 Oct 2026