Zyxel GS1900 Flaw CVE-2026-7273: 996 Switches Looted in August, CISA Gives Three Days

CISA added CVE-2026-7273, a stack-based buffer overflowStack-Based Buffer Overflow🛡️A memory-safety bug where input larger than a fixed-size buffer on the call stack overwrites adjacent stack data, including saved return addresses. Attackers use it to redirect execution and run arbitrary code, often without authentication when it sits in a request parser. in Zyxel's GS1900 series smart managed switches, to the Known Exploited Vulnerabilities catalog on 21 September 2026 and gave federal civilian agencies until 24 September to patch or pull the devices. The listing arrived the same day GreyNoise published evidence that a single actor had already used the bug to pull configurations and hashed root credentials off 996 switches in 48 countries, more than a month earlier.

What Happened

Zyxel disclosed the flaw on 16 June 2026 and shipped fixed firmwareFirmware🏠Permanent software programmed into a device's hardware that controls its basic functions. for ten GS1900 models at the same time. The advisory credits five researchers from the Institute of Software, Chinese Academy of Sciences (ISCAS) with the report. The bug lives in the CGI program that backs the switch's web management interface: a crafted HTTP request overflows a stack buffer and lets an unauthenticated attacker run operating-system commands on the switch. Zyxel scored it CVSS 3.1 8.8 with an attack vector of Adjacent, which is the vendor's way of saying the attacker needs to be on the same network as the management interface.

The attacker did not treat it that way. In a report published 21 September, GreyNoise described a campaign it tracks as "Kapibala," run by a suspected Chinese speaker apparently working in the UTC+8 time zone, that exploited CVE-2026-7273 on or about 17 August 2026. GreyNoise recovered the exploitExploit🛡️Code or technique that takes advantage of a vulnerability to cause unintended behavior, such as gaining unauthorized access. as a Python script obfuscated with PyArmor. The obfuscator was a 2021 release, version 6.7.5, and the operator left runtime references pinned to it, which made deobfuscation straightforward. The script's only purpose was to exploit this vulnerabilityVulnerability🛡️A weakness in software, hardware, or processes that can be exploited by attackers to gain unauthorized access or cause harm.. It targeted firmware versions 2.10 through 2.90 on the GS1900-24 by default and exposed command-line options to adapt to other versions in scope.

The payload is short. The exploit runs a shell command that uses TFTP to fetch a file from attacker infrastructure over port 6969 and immediately executes it with the system shell. That second-stage script collects device data into a temporary file and then copies it into a directory served by the switch's own web server, where the attacker can retrieve it with an ordinary HTTP request. Configuration exfiltration through the victim's own management interface leaves no outbound connection to a strange host, which is part of why it went unnoticed.

Who Is Affected

Zyxel lists ten models as vulnerable when running firmware 2.90 with a build suffix of .1)C0 or earlier: GS1900-8, GS1900-8HP, GS1900-10HP, GS1900-16, GS1900-24, GS1900-24E, GS1900-24EP, GS1900-24HPv2, GS1900-48 and GS1900-48HPv2. The fix in each case is the corresponding .2)C0 build. For the GS1900-24 that is 2.90(AAHL.2)C0; for the GS1900-48HPv2 it is 2.90(ABTQ.2)C0. The advisory states that on-market products not in the table are unaffected.

GreyNoise's victim count breaks down as 133 switches in Italy, 129 in the United States, 123 in Taiwan and 90 in France, with the remaining devices spread across 44 other countries. Of the 996 devices, 564 still had factory default credentialsDefault Credentials🛡️Passwords, keys, or secrets that ship with software or are silently generated when an operator does not set them. Deployments that never replace these values are open to anyone who reads the documentation or derives the fallback — one of the oldest persistent authentication failure classes. in place. For those, the stolen hash is a formality: the attacker already knew the password.

The GS1900 is a small-business and branch-office product. It is the class of switch that gets installed by an integrator, configured once through a browser and then forgotten, which is exactly the population that ends up with a web management interface reachable from the internet. GreyNoise's report does not address how an "adjacent network" bug was exploited against nearly a thousand devices on four continents, but there is only one plausible reading: those management interfaces were exposed. The CVSS vector describes Zyxel's assumption about deployment, not the deployment itself. Why a "LAN-only" CVSS rating does not mean the internet cannot reach it is a lesson this campaign teaches at scale.

Technical Analysis

Three things about this incident matter more than the CVE itself.

First, the loot. A managed switch's running configuration is a map of the network it serves: VLAN assignments, management addresses, SNMP community strings, RADIUSRADIUS🌐Remote Authentication Dial-In User Service, the protocol network devices use to ask a central server whether a user or device should be granted access and with what attributes. Each device shares a secret with the server, so a compromised server exposes the secrets of every device that trusts it. or TACACS server addresses and shared secrets if configured, syslog destinations and the local admin credential hash. The "networking information" GreyNoise says was taken almost certainly includes the address tables that enumerate the hosts attached to each port. That bundle is reconnaissance for the next intrusion, and the hashed root credential is crackable offline at the attacker's leisure. The exfiltrated data has a longer shelf life than the vulnerability.

Second, the actor's breadth. GreyNoise ties Kapibala to a run of opportunistic exploitation between 11 June and 3 September 2026 spanning Ubiquiti UniFi OS (CVE-2026-34908, CVE-2026-34909, CVE-2026-34910), FlowiseAI, WordPress plugins (CVE-2026-63030 and CVE-2026-60137), Nuclio, SENAITE LIMS, Proxmox VE and the Gitea remote code execution flaw CVE-2026-60004 that CISA listed in August. The WordPress activity alone netted more than 18,000 records from a western government organization, including plaintext passwords. GreyNoise assesses the group is the same as, or closely related to, the Red Heron cluster previously described by Acronis. This is a scanning-and-scripting operation that turns any recently published pre-authentication bug into a harvesting run within weeks, not a targeted campaign against switches specifically.

Third, the timeline. Patch available 16 June. Mass exploitation around 17 August. Public documentation and KEV listing 21 September. GreyNoise notes that as of 17 September this was the first publicly documented exploitation of the flaw, and that it was not yet in KEV when the report was written. Zyxel's advisory still carries a single revision-history entry for the initial release and says nothing about exploitation. Anyone who relied on the vendor page or the KEV catalog as their exploitation signal had a 35-day blind spot while the harvesting was already finished.

Immediate Actions

Establish exposure first. Find every GS1900 on the network, including the ones nobody remembers installing, and confirm whether the web interface answers from anywhere other than a management VLAN. If it is reachable from the internet or from user segments, that is the finding, regardless of firmware version.

Patch to the .2)C0 build for each model per Zyxel's advisory. The advisory offers no workaround, only the firmware update, so plan on touching every device rather than waiting for a mitigation that is not coming.

Treat any device that was exposed and unpatched between 17 August and now as compromised, because the exploit ran at scale and left no obvious trace. That means rotating the admin credential, replacing every secret that lives in the config, and reviewing what the switch's neighbors look like to an attacker holding its address tables. How to recover a managed switch after its config and root hash were stolen walks through that sequence. CISA has flagged this KEV entry for forensic triageForensic Triage🛡️A rapid, structured assessment of whether a system was compromised, performed alongside patching rather than after it. It prioritizes evidence the attacker could not have altered, such as network egress and authentication logs on other systems, over the affected host's own logs. under BOD 26-04BOD 26-04🛡️CISA Binding Operational Directive 26-04, issued 10 June 2026, which replaced BOD 22-01. It assigns federal civilian agencies remediation deadlines of 3, 14, or 60 days based on asset exposure, KEV status, exploit automation, and post-exploitation impact, and requires forensic triage for the 3-day tier., so federal teams are expected to check for compromise before they patch, not just apply the firmware and move on.

Block or alert on the infrastructure GreyNoise published: the staging host 74.48.66.73, the command-and-control domain pattern *.981666.xyz, and the addresses 104.225.153.141 and 172.245.247.21. GreyNoise withheld one further exploitation address pending victim notification. Outbound TFTP from a switch's management address to anything on the internet should never happen and is a clean detection.

Change factory default credentials on every managed network device, not just the GS1900s. More than half of the compromised switches were still on defaults, which means those operators would have lost the device to a login attempt even without a CVE.

Long-Term Outlook

CVE-2026-7273 will not be the last stack overflow in a CGI handler on a low-cost switch, and the GS1900 will not be the last device class that an opportunistic actor sweeps in bulk while the vendor advisory sits at "initial release." The structural problem is that smart managed switches occupy a gap in most patch programs: they are too numerous and too cheap to get server-style change control, and too capable to be ignored like unmanaged hardware. Why small-business switches are the forgotten tier of firmware patching is the planning conversation this incident should start.

The three-day KEV deadline is now routine for exploited edge and infrastructure bugs, as it was for the Gitea flaw the same actor exploited in August. The only way to hit a 72-hour window on devices that get updated one at a time is to already know where they are and already have their management planeManagement Plane🌐The interfaces and services used to configure and administer a device, as distinct from the data plane that carries user traffic. On a remote-access appliance the management plane is the admin console; exposing it to the internet or to the user-facing portal is a common root cause of privileged compromise. off the internet. Organizations that have neither will keep learning about compromises from a threat intelligence blog a month after the fact.

Sources

• CISA Known Exploited Vulnerabilities catalog feed, entry for CVE-2026-7273 (dateAdded 2026-09-21, dueDate 2026-09-24): https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
• CISA alert, 21 September 2026: https://www.cisa.gov/news-events/alerts/2026/09/21/cisa-adds-one-known-exploited-vulnerability-catalog
• Zyxel security advisory for CVE-2026-7273, 16 June 2026: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-stack-based-buffer-overflow-vulnerability-in-gs1900-series-switches-06-16-2026
• NVD record for CVE-2026-7273 (CVSS 3.1 8.8, AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-121): https://nvd.nist.gov/vuln/detail/CVE-2026-7273
• GreyNoise, "Open Season on Kapibala," 21 September 2026: https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation
• Help Net Security, 22 September 2026: https://www.helpnetsecurity.com/2026/09/22/zyxel-switches-cve-2026-7273-vulnerability-exploited/
• SecurityWeek, 22 September 2026: https://www.securityweek.com/recent-zyxel-switch-vulnerability-exploited-by-chinese-hackers/
• BleepingComputer, 22 September 2026: https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-actively-exploited-zyxel-flaw-by-thursday/