CVE-2026-7273

Unauthenticated attackers can execute OS commands on Zyxel GS1900 switches via a stack-based buffer overflow in the CGI program.

A LAN-based, unauthenticated attacker can exploit a stack-based buffer overflow in the CGI program of Zyxel GS1900 series switches to execute arbitrary OS commands via a crafted HTTP request. This is a critical failure for DIB organizations because it allows remote code execution without authentication, enabling lateral movement and potential ransomware deployment. Organizations must patch immediately and segment network access to mitigate this actively exploited vulnerability.

Shame score — The vulnerability allows unauthenticated remote code execution and is actively exploited in the wild, representing a severe negligence in patching and securing industrial network hardware.