CVE-2026-7273 is a high-severity stack-based buffer overflow vulnerability (CWE-121) in the CGI program of Zyxel GS1900 series managed switches. The flaw allows a LAN-based, unauthenticated attacker to send a crafted HTTP request and potentially execute arbitrary OS commands on the affected device.

The following GS1900 series switch models and firmware versions are affected:

• GS1900-8, firmware 2.90(AAHH.1)C0 and earlier
• GS1900-8HP, firmware 2.90(AAHI.1)C0 and earlier
• GS1900-10HP, firmware 2.90(AAZI.1)C0 and earlier
• GS1900-16, firmware 2.90(AAHJ.1)C0 and earlier
• GS1900-24, firmware 2.90(AAHL.1)C0 and earlier
• GS1900-24E, firmware 2.90(AAHK.1)C0 and earlier
• GS1900-24EP, firmware 2.90(ABTO.1)C0 and earlier
• GS1900-24HPv2, firmware 2.90(ABTP.1)C0 and earlier
• GS1900-48, firmware 2.90(AAHN.1)C0 and earlier
• GS1900-48HPv2, firmware 2.90(ABTQ.1)C0 and earlier

Not affected / patched version:

• Zyxel has released a patched firmware for each affected model, incrementing the final digit of the current build number (e.g. GS1900-8 fixed in 2.90(AAHH.2)C0). Confirm the exact patched build for your specific model against Zyxel's advisory before upgrading, as each model has its own build string.

Successful exploitation may allow attackers to:

• Trigger a stack-based buffer overflow in the switch's web-management CGI program via a crafted HTTP request
• Execute arbitrary OS commands on the affected switch without authentication
• Gain full control of network switching infrastructure, enabling further lateral movement, traffic interception, or denial of service across the LAN

CERTVU recommends the following:

1. Apply the vendor patch immediately

   Upgrade each affected GS1900 model to its corresponding fixed firmware release listed in Zyxel's advisory. Confirm the exact patched build for your specific model, since each model in the range has its own build string.

2. Treat this as a priority

3. Restrict management-interface access as an interim control

4. Disable unused web-management access