Stack-based buffer overflow in ZyXEL Communications Corp. products - CVE-2026-7273

Vulnerability identifier: #VU134725

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-7273

CWE-ID: CWE-121

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the CGI program. A remote attacker on the local network can trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

GS1900-8
GS1900-8HP
GS1900-48HPv2
GS1900-10HP
GS1900-48
GS1900-16
GS1900-24HPv2
GS1900-24
GS1900-24EP
GS1900-24E

Install updates from vendor's website.

GS1900-8 - update to 2.90(AAHH.2)C0
GS1900-8HP - update to 2.90(AAHI.2)C0
GS1900-48HPv2 - update to 2.90(ABTQ.2)C0
GS1900-10HP - update to 2.90(AAZI.2)C0
GS1900-48 - update to 2.90(AAHN.2)C0
GS1900-16 - update to 2.90(AAHJ.2)C0
GS1900-24HPv2 - update to 2.90(ABTP.2)C0
GS1900-24 - update to 2.90(AAHL.2)C0
GS1900-24EP - update to 2.90(ABTO.2)C0
GS1900-24E - update to 2.90(AAHK.2)C0

• https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-stack-based-buffer-overflow-vulnerability-in-gs1900-series-switches-06-16-2026

• Stack-based buffer overflow in Zyxel GS1900 series switches