Recent ZyXEL Switch Vulnerability Exploited by Chinese Hackers
Chinese hackers exploited ZyXEL CVE-2026-7273 on GS1900 switches in 48 countries; CISA added it to KEV.
GreyNoise says a Chinese threat actor exploited CVE-2026-7273, an unauthenticated stack-based buffer overflow (CVSS 8.8) in ZyXEL GS1900 switches, against devices in 48 countries in August. An obfuscated Python script pulled hashed root credentials, configuration, and network data from 996 devices; 564 still used factory-default credentials. ZyXEL patched ten GS1900 models in June, and CISA added the flaw to the KEV catalog with a three-day federal deadline under BOD 26-04. The same actor chained Ubiquiti bugs for remote code execution, targeted WordPress in July, stole over 18,000 records from a Western government body, and is assessed as Red Heron or closely related.
- CVE-2026-7273 is an unauthenticated stack overflow in ZyXEL GS1900 switches, CVSS 8.8.
- A Chinese group hit devices in 48 countries in August and stole data from 996 switches.
- 564 compromised devices still used factory-default credentials.
- CISA added the bug to KEV, giving agencies three days to patch under BOD 26-04.
- GreyNoise links the actor to Red Heron and separate Ubiquiti and WordPress attacks.
- CVEs
- CVE-2026-7273
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-7273 | Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability | 8.8 | 3% | KEVPoC | KEV |
From the original article
1 min read at securityweek.com
A Chinese threat actor has exploited the bug to exfiltrate sensitive information from nearly 1,000 ZyXEL switches. The post Recent ZyXEL Switch Vulnerability Exploited by Chinese Hackers appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.