Vulnerabilities

Zyxel switch flaw exploited two months post-patch

By Yaali. September 27, 2026, 5 min read, Vulnerabilities, Patching, Threat intel.

CVE-2026-7273 was fixed in June, but a Chinese-speaking actor still ran a campaign against it on 996 Zyxel GS1900 switches in 48 countries. Fixed versions and compromise checks inside.

Zyxel shipped a fix for CVE-2026-7273, a stack-based buffer overflow in ten GS1900 switch models, on June 16, 2026. The flaw sat patched and mostly unapplied for two months before anyone ran a real campaign against it. CISA (the Cybersecurity and Infrastructure Security Agency) only added it to its Known Exploited Vulnerabilities (KEV) catalog on September 21, because a suspected Chinese-speaking threat actor had been weaponizing it since August 17, roughly two months after the patch already existed.

By the time CISA acted, the campaign had compromised and pulled data off 996 Zyxel switches across 48 countries, including Italy, the United States, Taiwan, France and South Korea. CVE-2026-7273 carries a CVSS score of 8.8, and it needs no valid login, so any GS1900 switch running old firmware and reachable on its management interface was a candidate. If your network has GS1900 gear sitting in a closet that nobody has touched since installation, this is worth ten minutes right now.

How it works

A GS1900 switch runs a small web server for its browser-based admin interface, and behind that server sits a CGI (Common Gateway Interface) program, the code that takes an incoming HTTP request, such as a login or a settings change, and turns it into an action on the switch. CVE-2026-7273 lives in how that program reads a request. It copies part of the incoming data into a fixed-size buffer on the stack, the region of memory a function uses for its own short-lived, local data, without checking how long that incoming data actually is.

Send more bytes than the buffer holds and the extra data overwrites whatever memory sits next to it, including the address the function is due to return to once it finishes. Set that overwritten address to point at code of your choosing, and when the function returns, execution jumps there instead, letting the attacker run their own operating-system commands on the switch, all from one oversized, crafted HTTP request.

Zyxel's own advisory calls the attacker "LAN-based, unauthenticated," and the two halves matter separately. Unauthenticated means no username or password is needed, only a request reaching the switch's management interface. LAN-based means that request has to arrive over whichever network the interface actually listens on, not necessarily the same switch port, but wherever that service is exposed. A GS1900 with web management reachable from the internet, through a port forward or an exposed WAN address, is reachable by anyone. One that only ever sees traffic from a locked-down management subnet is reachable only by someone already on it, which decides how exposed a given deployment actually was.

Once a command runs on the switch, there is little installed on it to work with, so the observed attacks reused what was already there. They ran the switch's own TFTP (Trivial File Transfer Protocol) client, a bare-bones, unauthenticated file-transfer tool built into the firmware, to pull a custom collector script down from attacker infrastructure and execute it on the spot. That script gathered the switch's configuration, its networking information, and the hashed value of its root-level credentials, then sent all three back out.

What attackers are doing

Help Net Security and SecurityWeek, both citing research attributed to GreyNoise, put the start of this campaign at August 17, 2026, run by a suspected Chinese-speaking threat actor. By September 21, when CISA listed the CVE, the tally stood at 996 compromised switches across 48 countries, heaviest in Italy, the United States, Taiwan, South Korea and other EU member states; separate reporting on the same campaign also names France.

Of those 996, 564 were still running Zyxel's factory default credentials, so the buffer overflow was not even the only way in on most of them, only on the ones that had actually been given a real password. The exploit itself traveled as a Python script wrapped in PyArmor, a commercial obfuscation tool, which points to some deliberate effort to keep the tooling from being read or fingerprinted quickly. CISA gave federal agencies until September 24 to patch, three days after the KEV listing, for hardware that mostly has not been logged into since the day it was racked.

What to do

Patch. Zyxel's June 16 advisory lists fixed firmware for all ten affected GS1900 models. Firmware 2.90(XXXX.1)C0 and earlier is vulnerable for each model; the fix is the matching 2.90(XXXX.2)C0 build.

Download the build matching your model from Zyxel's support downloads page and upload it through the switch's own web management interface, since that CGI service is what you are patching.

If you cannot patch today. Move the management interface off any network an ordinary device or a guest segment can reach, behind a dedicated management VLAN or a trusted administrative subnet, since the flaw only fires when a crafted request reaches that CGI service at all. If nobody uses the web GUI or remote management day to day, turn it off entirely.

Check whether you were already hit. GS1900 switches keep little local logging, so check whatever centralized syslog collector you point them at, if any, for TFTP client activity from the switch itself or execution of a script it did not ship with. If you recorded the admin or root credential hash before now, compare it against the current one. These devices hold little forensic detail on their own, so treat any switch that was reachable from the internet or a broad, unsegmented LAN, and unpatched since June, as already compromised: reset every credential on it and reflash the firmware rather than only installing the update, since an attacker may have had months of access.

Our network penetration tests check exactly this kind of exposed management interface on switches and routers, and our attack surface management work tracks which of your devices still have a management port reachable from somewhere it should not be. Open the chat and Yaali, our AI agent, will pass your question to the engineer who would do the work.

Sources: Help Net Security: attacker compromised nearly 1,000 Zyxel switches since August, SecurityWeek: recent Zyxel switch vulnerability exploited by Chinese hackers, CISA: one vulnerability added to KEV catalog, September 21, 2026, Zyxel security advisory for GS1900 series switches, June 16, 2026, The Hacker News: Zyxel and Veeam flaws under active exploitation, nFlo knowledge base: CVE-2026-7273 technical summary.