GS1900 (Product): news timeline & CVEs

Week in review: Gyazo breach exposes 23.6M user data, TASK#STOMP steals documents

Weekly roundup leads with a Gyazo breach of 23.6 million users and the TASK#STOMP document-stealing backdoor.

Helpfeel confirmed that hackers exploited a Gyazo server flaw and stole 23.6 million user records. The same weekly digest details TASK#STOMP, a Windows backdoor that uploads business documents and also takes Wi-Fi passwords, clipboard text, and screenshots. A Chinese-speaking actor exploited CVE-2026-7273 on 996 unpatched Zyxel GS1900 switches in 48 countries, and Check Point said CVE-2026-93616 has been exploited since July 23, 2026. Elsevier domains were briefly redirected to a LAPSUS$ page, while DarkMe is now spread by ordinary phishing email.

Help Net Security08:00 UTC · 1h agoData breach in the wildCVE-2026-7273 CVE-2026-85102 CVE-2026-93616

Recent ZyXEL Switch Vulnerability Exploited by Chinese Hackers

Chinese hackers exploited ZyXEL CVE-2026-7273 on GS1900 switches in 48 countries; CISA added it to KEV.

GreyNoise says a Chinese threat actor exploited CVE-2026-7273, an unauthenticated stack-based buffer overflow (CVSS 8.8) in ZyXEL GS1900 switches, against devices in 48 countries in August. An obfuscated Python script pulled hashed root credentials, configuration, and network data from 996 devices; 564 still used factory-default credentials. ZyXEL patched ten GS1900 models in June, and CISA added the flaw to the KEV catalog with a three-day federal deadline under BOD 26-04. The same actor chained Ubiquiti bugs for remote code execution, targeted WordPress in July, stole over 18,000 records from a Western government body, and is assessed as Red Heron or closely related.

SecurityWeekSep 22, 11:55 UTC · 4d agoExploit / PoC in the wild 8 sources CVE-2026-7273

U.S. CISA adds Zyxel flaw to its Known Exploited Vulnerabilities catalog

CISA added exploited Zyxel GS1900 switch flaw CVE-2026-7273 to the KEV catalog, with a September 24 fix deadline.

CISA added CVE-2026-7273, a stack-based buffer overflow in the CGI program of Zyxel GS1900 series switch firmware, to the Known Exploited Vulnerabilities catalog. The flaw, scored CVSS 8.8, lets an unauthenticated attacker on the local network send a crafted HTTP request and potentially execute operating-system commands. Zyxel patched affected models in 2.90 firmware builds, and federal civilian agencies must remediate by September 24, 2026. CISA did not name attackers; researchers at ISCAS are credited with the report.

Security Affairsupdated Sep 22, 11:55 UTC · 4d agofirst Sep 22, 09:13 UTC · 4d agoExploit / PoC in the wild 8 sources CVE-2026-7273

Zyxel security advisory (AV26-603) – Update 1

Canada's Cyber Centre says Zyxel GS1900 buffer overflow CVE-2026-7273 is now in CISA's KEV catalog.

The Canadian Centre for Cyber Security updated advisory AV26-603 after CISA added CVE-2026-7273 to the Known Exploited Vulnerabilities catalog on September 21, 2026. Zyxel first published the advisory on June 16, 2026, for vulnerabilities in multiple versions and models of GS1900 series switches. The listed issue is a stack-based buffer overflow. The Cyber Centre urges administrators to review Zyxel's advisory and CISA's KEV entry and apply updates.

Canadian Centre for Cyber Securityupdated Sep 22, 11:55 UTC · 4d agofirst Sep 21, 20:12 UTC · 5d agoExploit / PoC in the wild 8 sources CVE-2026-72731

GS1900

Timeline4 articles

Related CVEsby mentions

Appears with

Week in review: Gyazo breach exposes 23.6M user data, TASK#STOMP steals documents

Recent ZyXEL Switch Vulnerability Exploited by Chinese Hackers

U.S. CISA adds Zyxel flaw to its Known Exploited Vulnerabilities catalog

Zyxel security advisory (AV26-603) – Update 1