The Cybersecurity and Infrastructure Security Agency (CISA) has added a high-severity buffer overflow flaw, tracked as CVE-2026-7273 (CVSS 8.8), affecting Zyxel GS1900 series managed switches to its Known Exploited Vulnerabilities catalog. The vulnerability lies within the CGI web management binary across firmware versions 2.90(AAxx.1)C0 and earlier. An unauthenticated attacker with network reachability can transmit crafted HTTP requests with oversized parameters, corrupting the stack to hijack control flow and execute arbitrary operating system commands with root privileges.

Telemetry from GreyNoise reveals active exploitation by a suspected Chinese-speaking threat actor since mid-August 2026, compromising nearly 1,000 switches across 48 countries. Attackers deploy automated TFTP stagers and obfuscated collector scripts to exfiltrate running configurations, network routing tables, and hashed credentials from affected devices. CISA issued Binding Operational Directive 26-04 mandating federal agencies remediate the flaw by September 24, 2026. Zyxel released patched firmware version 2.90(AAxx.2)C0; administrators must upgrade immediately and isolate web management access to dedicated out-of-band VLANs.

Why it matters:

• Technical & Architecture Risk: Unauthenticated stack buffer overflows in network switch management daemons bypass traditional host-level endpoint detection (EDR), allowing adversaries to subvert layer-2/layer-3 switching fabrics, harvest cryptographic credentials, and pivot silently across segmented internal networks.
• Strategic & Defender Imperative: Organizations must immediately deploy Zyxel firmware 2.90(AAxx.2)C0 to comply with emergency remediation deadlines, restrict switch management interfaces strictly to out-of-band administration VLANs, and audit devices for modified configurations or unexpected TFTP traffic.