CISA orders feds to patch Zyxel flaw exploited for data theft
CISA added actively exploited Zyxel GS1900 flaw CVE-2026-7273 to KEV, ordering federal agencies to patch by Thursday after ~1,000 switches were compromised.
CISA added CVE-2026-7273, a stack-based buffer overflow in the CGI program of Zyxel GS1900 switches allowing unprivileged LAN attackers to execute OS commands via crafted HTTP requests, to its KEV Catalog and ordered FCEB agencies to patch by Thursday under BOD 26-04; Zyxel shipped fixes on June 16. GreyNoise reported a suspected Chinese-speaking actor exploiting the flaw as a novel vector since mid-September, compromising and exfiltrating data from 996 switches across 48 countries while targeting over a dozen other vulnerabilities. CISA tracks 13 total exploited Zyxel vulnerabilities across routers, switches, firewalls, and NAS devices; affected models span GS1900-8 through GS1900-48HPv2 with firmware 2.90 variants.
- CVE-2026-7273 KEV addition; FCEB patch deadline Thursday under BOD 26-04
- GreyNoise: first in-the-wild exploitation documented September 17, 2026
- Suspected Chinese-speaking actor exfiltrated data from 996 switches in 48 countries
- Unprivileged LAN attackers can execute OS commands via crafted HTTP requests
- Patches available since June 16 across ten GS1900 models
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1059 Command and Scripting InterpreterT1005 Data from Local System
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-40891 | Post-Authentication OS Command Injection in Zyxel DSL CPE Devices | 8.8 | 23% | KEV | KEV |
| CVE-2026-7273 | Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability | 8.8 | 3% | KEVPoC | KEV |
From the original article
2 min read at bleepingcomputer.com
Attackers are now actively exploiting a high-severity vulnerability in Zyxel GS1900 series switches, according to the U. S. Cybersecurity and Infrastructure Security Agency (CISA).
By Sergiu Gatlan · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.