Why a "LAN-Only" CVSS Rating Does Not Mean the Internet Cannot Reach It

When Zyxel scored CVE-2026-7273, the stack-based buffer overflowStack-Based Buffer Overflow🛡️A memory-safety bug where input larger than a fixed-size buffer on the call stack overwrites adjacent stack data, including saved return addresses. Attackers use it to redirect execution and run arbitrary code, often without authentication when it sits in a request parser. in its GS1900 switches, it assigned a CVSS attack vector of Adjacent. That single letter in the vector string, AV:A, tells a vulnerabilityVulnerability🛡️A weakness in software, hardware, or processes that can be exploited by attackers to gain unauthorized access or cause harm. management program that the attacker must already be on the same network segment as the target. Plenty of triage pipelines translate that into "internal only, schedule it for the next maintenance window." Then a single opportunistic actor exploited the flaw on 996 switches across 48 countries in a matter of days. The rating was not wrong. The assumption behind it was.

What the Attack Vector Metric Actually Measures

CVSS defines four attack vector values. Network means the vulnerability is reachable across routed networks, including the internet. Adjacent means the attacker must share a broadcast domain or a physically or logically adjacent network with the target, such as the same Wi-Fi, the same VLAN or the same Bluetooth range. Local means the attacker needs code execution or a session on the host already. Physical means hands on the hardware.

The metric describes the vulnerable component's design context. When a vendor rates a management interface bug as Adjacent, the vendor is stating that the interface is intended to be reachable only from a local management network. That is a statement about how the product is supposed to be deployed, not a measurement of where the interface is actually listening today.

The CVSS specification is explicit that the base score reflects the intrinsic characteristics of the vulnerability and that organizations should apply environmental metrics to reflect their own situation. Almost nobody does that step. The base score gets copied into a ticket, mapped to an SLA and the ticket goes into the queue behind everything scored Network.

How an Adjacent-Only Interface Ends Up on the Internet

A management interface designed for the LAN reaches the internet through a small number of well-worn paths, and most of them do not involve anyone consciously deciding to expose it.

The device gets a public address directly. Small offices that run a single flat network behind a consumer or ISP-provided routerRouter🌐A device that directs data packets between your local network and the internet. often plug a switch's management port into a segment that has no separation from the WAN side at all. The switch is on the "LAN" from the vendor's point of view and on the internet from everyone else's.

A port forward is created for remote administration and never removed. An integrator sets up remote access to finish the job or to support the customer later. It works, so it stays.

The management VLAN is not actually separate. Many small-business switches ship with the management interface on VLAN 1 alongside every user port. If nothing is done to move it, every host on the network, including any compromised laptop or infected printer, is "adjacent" to the switch. That is still a LAN attack in the CVSS sense, but the attacker on that laptop got there over the internet.

A VPN or remote-access appliance bridges the gap. Once an attacker holds a foothold inside the perimeter through any other route, adjacency is a given. Every Adjacent-rated bug on the network becomes a lateral-movement tool, which is precisely how the campaign against Zyxel switches fits the same actor's exploitation of Gitea, Ubiquiti and WordPress flaws: any way in, then harvest whatever is nearby.

In the Zyxel case, GreyNoise's numbers (133 victims in Italy, 129 in the United States, 123 in Taiwan, 90 in France) describe an internet-scale sweep. That is only possible if the web interface of those switches answered from the public internet. The vendor rated the bug for a deployment that a thousand operators did not have.

Reading a Vector String Defensively

The practical fix is to stop treating the attack vector as a fact about your exposure and start treating it as a question to answer.

For every Adjacent or Local rating on a device you own, ask what "adjacent" means for that specific device in your network. Is the management interface on a dedicated VLAN with an access list? Is it reachable from user segments? Is there any NAT rule, port forward or reverse proxyReverse Proxy🛡️A server that sits in front of one or more backend services, terminating client connections and forwarding requests to the backend. It is the standard place to add authentication, TLS and access control to a service that lacks its own, without modifying the application. that maps it outward? If the honest answer is "I do not know," the effective attack vector is Network until proven otherwise.

Use the environmental metrics for the cases that matter. CVSS provides Modified Attack Vector precisely so that a defender can re-score a bug as Network when the component is exposed in their environment. Even if the tooling does not support it, the reasoning should: an Adjacent 8.8 on an exposed interface is a Network 9.8 in practice, because removing the adjacency requirement is the only thing separating the two.

Weight pre-authentication above the vector. CVE-2026-7273 needed no credentials and no user interaction. An unauthenticated remote code execution bug in a management interface is critical wherever that interface is reachable, and the vector only tells you how far the attacker has to travel to reach it.

Watch exploitation signals independently of the score. The Zyxel bug was patched in June, exploited at scale in August and listed in CISA's Known Exploited Vulnerabilities catalog in September. Its CVSS score never changed. Anyone whose prioritization keyed on the score alone had no reason to move it up the queue until the harvesting was already done. Why small-business switches are the forgotten tier of firmwareFirmware🏠Permanent software programmed into a device's hardware that controls its basic functions. patching covers how to build that signal into a process for device classes that do not get server-style attention.

What This Means for the Devices You Already Have

Make the assumed adjacency real. Put management interfaces on a dedicated VLAN that user devices cannot route to, restrict that VLAN to a jump host or administrative subnet, and verify from outside that nothing on the public address answers on the management ports. This turns the vendor's AV:A assumption from fiction into fact, and it is the single change that would have kept nearly every one of those 996 switches out of the campaign regardless of patch state.

Then check whether that assumption was already violated. If a device with an Adjacent-rated pre-authentication bug was reachable from the internet during the exploitation window, the rating did not protect it and the device should be handled as compromised. How to recover a managed switch after its config and root hash were stolen covers that process for the Zyxel case specifically.

The attack vector is the most-misread field in a CVSS string because it looks like a property of the bug when it is really a property of the deployment. Vendors can only score for the deployment they intended. Only the operator knows the one that exists.