home / blog
2026-11-03 · high
CVE-2026-7273: Buffer Overflow in Zyxel GS1900-48HPv2
Stack-based buffer overflow in Zyxel GS1900-48HPv2 CGI with CVSS 8.8. Unauthenticated LAN-based attacks.
CVE-2026-7273 is a stack-based buffer overflow in the CGI program of the Zyxel GS1900-48HPv2 switch. A specially crafted HTTP request from an unauthenticated LAN-based attacker can trigger the overflow and cause OS command execution. This common enterprise network device's unauthenticated web service represents significant infrastructure risk.
The CVSS score is 8.8 (High rating), though officially declared Critical. Published on NVD June 16, 2026, it was added to the KEV catalog per technical sources. Active discussions in technical media (latest November 3, 2026) suggest possible patch bypass, not yet officially confirmed. The absence of public GitHub exploits does not exclude alternative activity.
IT teams and system administrators must prioritize inventory of all Zyxel GS1900-48HPv2 switches in use. It is critical to update firmware beyond version 2.90(ABTQ.1)C0; patch availability and effectiveness should be verified before deployment in critical environments. In the interim, strengthen LAN access controls, monitor CGI access logs for anomalous patterns, and implement network segmentation if the device is in critical zones.
At a glance
- What
- Stack-based buffer overflow in the CGI program of Zyxel GS1900-48HPv2 switch. The vulnerability allows OS command execution via specially crafted HTTP request.
- Severity
- CVSS 8.8 (High). Official records declare it Critical. Enables RCE from unauthenticated LAN-based attackers.
- Affected versions
- Zyxel GS1900-48HPv2 versions through 2.90(ABTQ.1)C0
- Fix
- Update firmware beyond version 2.90(ABTQ.1)C0. Patch effectiveness: not yet officially confirmed in all contexts.
- Status
- Published on NVD June 16, 2026. Added to KEV catalog per technical reports. Active discussion in technical media (latest post November 3, 2026). Active exploitation: not officially confirmed but reported as potential.
- Action
- Urgent audit of all GS1900-48HPv2 switches in production. Plan prioritized firmware update with patch validation. Monitor CGI access from LAN. Strengthen network segmentation. Review logs for anomalous web access patterns.
Sources: NVD, CVE-2026-7273