CISA says attackers are actively exploiting a Zyxel switch bug, and organizations using affected GS1900 models should patch quickly. The flaw, CVE-2026-7273, is a stack-based buffer overflow in the GS1900 series CGI web-management component that lets an attacker on the local area network send crafted HTTP requests to execute operating-system commands. Zyxel patched affected GS1900 models in June, and GreyNoise says a suspected Chinese-speaking actor exploited nearly 1,000 switches in 48 countries and exfiltrated sensitive data.
Why it matters: These are network switches used in many business environments, so successful exploitation can give attackers a foothold inside an organization and lead to data theft. Affected users should identify GS1900 devices, install the patched firmware immediately, and restrict management access where possible.
Bill Toulas
2026.09.22
84% relevant
This provides campaign detail behind the active exploitation warning, attributing widespread attacks on Zyxel GS1900 switches to a Chinese-speaking actor that compromised 996 devices in 48 countries and stole configurations, network data, and hashed root credentials.
Ionut Arghire
2026.09.22
96% relevant
This article adds concrete exploitation details to the existing CVE-2026-7273 story: GreyNoise attributes August exploitation to a Chinese threat actor, says 996 devices in 48 countries were hit, describes theft of hashed root credentials and configuration data, notes 564 devices still used default credentials, and links the activity to a Red Heron-related cluster.
Sergiu Gatlan
2026.09.22
100% relevant
This article establishes a new tracked event: active exploitation of CVE-2026-7273 in Zyxel GS1900 switches, its addition to CISA's KEV catalog, and a federal remediation deadline.
← Back to all stories