CVE-2026-7273

HighCVSS 8.8/10Known exploited (CISA KEV)Last modified Oct 25, 2026

Description

A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121

Affected software

Vendor	Product	Versions
Zyxel	GS1900-48HPv2 firmware	<= 2.90(ABTQ.1)C0
Zyxel	GS1900-8 firmware	<= 2.90(AAHH.1)C0
Zyxel	GS1900-8HP firmware	<= 2.90(AAHI.1)C0
Zyxel	GS1900-10HP firmware	<= 2.90(AAZI.1)C0
Zyxel	GS1900-16 firmware	<= 2.90(AAHJ.1)C0
Zyxel	GS1900-24 firmware	<= 2.90(AAHL.1)C0
Zyxel	GS1900-24E firmware	<= 2.90(AAHK.1)C0
Zyxel	GS1900-24EP firmware	<= 2.90(ABTO.1)C0
Zyxel	GS1900-24HPv2 firmware	<= 2.90(ABTP.1)C0
Zyxel	GS1900-48 firmware	<= 2.90(AAHN.1)C0

References

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-stack-based-buffer-overflow-vulnerability-in-gs1900-series-switches-06-16-2026Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-7273Third Party Advisory, US Government Resource
https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitationExploit, Third Party Advisory

Timeline

Published: Jun 16, 2026
Last modified: Oct 25, 2026
Added to CISA KEV: Sep 21, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-727308.7Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the Rich Text Editor rendered a chat-t CVE-2026-727317.1Discourse is an open-source discussion platform. From 2026.1.0-latest until 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, anyone able CVE-2026-727324.3Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the discourse_templates endpoint expos CVE-2026-727339.9Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the backup.restoreBackupWithLogs tRPC subscription builds d CVE-2026-727348.4Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.28.7 until 0.29.13, the server.remove tRPC mutation in apps/dokploy/se CVE-2026-727359.9Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, writeTraefikConfigRemote in packages/server/src/utils/traef CVE-2026-727369.9Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy passes user-controlled values directly into shell c CVE-2026-727379.6Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.29.8 and earlier, backup.create, backup.update, and backup.restoreBackup CVE-2026-727389.9Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the backup.listBackupFiles tRPC endpoint in apps/dokploy/se CVE-2026-727396.5Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the createCommand() function constructs shell commands by i CVE-2026-727409.9Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, packages/server/src/utils/providers/git.ts parses the user-CVE-2026-727418.1Rainbond through 6.9.7 contains a broken access control vulnerability in the CheckToken function that allows authenticated attackers to acce