CVE-2026-72738.8HighCWE-121
Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability
Zyxel · GS1900-48HPv2 firmware
Exploited in the wild · in CISA KEV since 21 SepVendor fix availableExploitation attributed to Red Heron (per GreyNoise, SecurityOnline)
2.8%probability of exploitation in the next 30 days
86th percentile
050100
Higher than 86% of scored CVEs
8.8HighCVSS 3.1
LowMediumHighCrit.
Federal deadline
CISA KEV · added 21 Sep · catalogue entry
Passed 37 days ago
DescriptionNVD
A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.
CISA required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Coverage6 articles · 4 outlets
One row per outlet, in order of first report; the chart covers the last 90 days. First in our coverage: SecurityOnline, 18 Jun.
Quiet for 6 weekslast report 22 Sep6 articles4 outlets
- Thu 18 Jun, 02:31 UTC. SecurityOnline, first report. Zyxel fixes CVE-2026-7273 buffer overflow in GS1900 switches. Cites a CVE in CISA KEV.
- Mon 21 Sep, 20:01 UTC. CISA, its first report on the story. CISA Warns of Active Zyxel Switch Attacks via Command Flaw. Cites a CVE in CISA KEV.
- Tue 22 Sep, 04:23 UTC. SecurityOnline. Suspected Chinese Actor Exposed 18,566 Government Records in Campaign. Cites a CVE in CISA KEV.
- Tue 22 Sep, 04:23 UTC. SecurityOnline. US Authorities Warn of Zyxel Switch Flaw Exploited in Attacks. Cites a CVE in CISA KEV.
- Tue 22 Sep, 10:36 UTC. Security Affairs, its first report on the story. CISA Flags Zyxel Switch Flaw Exploited in Network Attacks. Cites a CVE in CISA KEV.
- Tue 22 Sep, 12:22 UTC. SecurityWeek, its first report on the story. Chinese Hackers Exploit Zyxel Switch Flaw to Steal Credentials. Cites a CVE in CISA KEV.
- First report
- Article
- Official notice
- Running total
Added to CISA KEV
Show as tableHide table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| 21 Sep 20:01 | CISA | CISA Warns of Active Zyxel Switch Attacks via Command Flaw |
| 22 Sep 04:23 | SecurityOnline | Suspected Chinese Actor Exposed 18,566 Government Records in Campaign |
| 22 Sep 04:23 | SecurityOnline | US Authorities Warn of Zyxel Switch Flaw Exploited in Attacks |
| 22 Sep 10:36 | Security Affairs | CISA Flags Zyxel Switch Flaw Exploited in Network Attacks |
| 22 Sep 12:22 | SecurityWeek | Chinese Hackers Exploit Zyxel Switch Flaw to Steal Credentials |
- CISA Flags Zyxel Switch Flaw Exploited in Network AttacksSecurity Affairs
- Suspected Chinese Actor Exposed 18,566 Government Records in CampaignSecurityOnline · mentions it in passing
- CISA Warns of Active Zyxel Switch Attacks via Command FlawCISA · official notice
- Zyxel fixes CVE-2026-7273 buffer overflow in GS1900 switchesSecurityOnline · first in our coverage
New articles also arrive in the RSS feed.