CVE-2026-7273 · High · CISA KEV

Zyxel GS1900 Switches: Unauthenticated LAN OS Command Execution (KEV)

Threat Engine Auto-Feed · data current as of 2026-09-22

A stack-based buffer overflow in Zyxel GS1900 series switches allows an unauthenticated attacker on the local network to execute OS commands via a crafted HTTP request. This vulnerability is listed in CISA KEV, indicating active exploitation in the wild, and has an EPSS score in the 80th percentile.

  • CVSS:
  • EPSS percentile: 0.7972
  • Exploitation pressure: 73/100 (High)

Exploitation reality: listed in CISA KEV (exploited in the wild) · EPSS 80th percentile. Threat × Vulnerability from public signals — impact depends on your environment.

Weakness —

A stack-based buffer overflow occurs when a program writes more data to a buffer located on the call stack than it was intended to hold. This excess data overflows into adjacent memory, potentially overwriting other data or control flow information, which can be manipulated by an attacker to execute arbitrary code or commands.

Who's at risk

Exposure: unknown · Auth: unknown · unknown

Enterprise profiles most at risk

  • Organizations utilizing Zyxel GS1900 series switches within their internal networks.
  • Financial services organizations, due to documented targeting by financially motivated actors like FIN7, LockBit affiliates, and APT38.
  • Technology sector organizations, due to documented targeting by espionage groups like APT29 and identity-focused groups like Scattered Spider.

Misconfigurations that escalate it

  • Lack of network segmentation, allowing unauthenticated access to switch management interfaces from internal user networks.
  • Insufficient monitoring of internal network traffic for anomalous HTTP requests targeting network infrastructure devices.

High-impact scenarios

  • An attacker gaining full control over affected switches, potentially leading to network disruption or manipulation of traffic.
  • Lateral movement within the network by an attacker who has already established a foothold on an internal host.
  • Unauthorized access to sensitive network configurations or data passing through the switch.

Likely adversaries

  • FIN7 — Financial services (Assessed)
  • LockBit affiliates — Financial services (Assessed)
  • APT38 (Lazarus) — Financial services (Assessed)
  • APT29 (Cozy Bear) — Technology (Assessed)
  • Scattered Spider — Technology (Assessed)

What to do (defensive)

Detect

  • Monitor network traffic for unusual HTTP requests targeting Zyxel GS1900 series switches, especially those with abnormally long or malformed parameters.
  • Implement network intrusion detection systems (NIDS) with signatures for known exploitation attempts against Zyxel GS1900 vulnerabilities.
  • Regularly review switch logs for signs of unauthorized access or command execution.

Contain

  • Isolate affected Zyxel GS1900 series switches from critical network segments if immediate patching is not feasible.
  • Restrict management interface access to only trusted administrative networks and hosts.
  • Implement strict network segmentation to limit the blast radius of a compromised switch.

Patch

  • Apply vendor-provided security updates for Zyxel GS1900 series switches immediately upon availability.

Frontier verdict — High

This is a high-priority vulnerability due to active exploitation in the wild (CISA KEV), potential for unauthenticated OS command execution on the LAN, and documented targeting by sophisticated threat actors.

For detection-engineering and awareness only · point-in-time · not security advice · sourced from NVD, FIRST EPSS, CISA KEV. Adversary mappings are assessments unless cited.