Zyxel Switch Flaw Hits 996 Devices in 48 Countries

An unauthenticated attacker who can reach a Zyxel GS1900 switch's web management interface can run arbitrary operating-system commands with a single crafted HTTP request, and GreyNoise says a Chinese-speaking group has been doing exactly that since Aug. 17.

The Cybersecurity and Infrastructure Security Agency added the flaw, CVE-2026-7273, to its Known Exploited Vulnerabilities catalog on Sept. 21, giving federal civilian agencies until Sept. 24 to patch under Binding Operational Directive 26-04. GreyNoise, which first reported the campaign, said the actor has compromised 996 switches in 48 countries, concentrated in Italy, the United States, Taiwan and South Korea.

What the CVSS score doesn't capture

The National Vulnerability Database rates CVE-2026-7273 at 8.8 with an attack vector of adjacent network, the tier CVSS reserves for a flaw reachable only from inside a local network or a device already on one. For one actor to reach 996 switches spread across 48 countries, the switches' web interfaces would have to be answering requests from the open internet rather than a private network, a precondition the adjacency rating does not anticipate.

Zyxel's own advisory, published June 16, describes the flaw as a stack-based buffer overflow in the switch firmware's CGI program, exploitable by a LAN-based, unauthenticated attacker who sends a crafted HTTP request. It affects ten GS1900 models, with fixes released as a .2)C0 point update for each. Lei Gu, Jun Cao, Zhiqing Rui, Jingzheng Wu and Tianyue Luo of the Institute of Software, Chinese Academy of Sciences, are credited with reporting it.

Model	Vulnerable firmware	Fixed firmware
GS1900-8	2.90(AAHH.1)C0 and earlier	2.90(AAHH.2)C0
GS1900-8HP	2.90(AAHI.1)C0 and earlier	2.90(AAHI.2)C0
GS1900-10HP	2.90(AAZI.1)C0 and earlier	2.90(AAZI.2)C0
GS1900-48HPv2	2.90(ABTQ.1)C0 and earlier	2.90(ABTQ.2)C0

What attackers took

GreyNoise said the actor ran a Python script obfuscated with the commercial tool PyArmor to deploy a TFTP-based collector that pulled configuration files, network settings and hashed root-level credentials off each switch. Of the 996 compromised devices, 564 were still running Zyxel's factory default password, according to GreyNoise's findings as reported by SecurityWeek, meaning the stolen hashes were often unnecessary.

GreyNoise said the campaign's "most egregious data theft occurred against an identified western governmental organization involving more than 18,000 sensitive records stolen." It linked the actor to earlier campaigns against Ubiquiti devices, WordPress installations and Gitea instances, and said the group may overlap with one researchers track as Red Heron.

The pattern CISA's list keeps repeating

This is the second time in three weeks that CISA has added a network-appliance flaw to its exploited list only after a private security firm's own reporting outran the public record; the same gap showed up in CISA's fourth addition from a single MikroTik disclosure, where two of six flaws in one batch sat off the list for 15 days after the first pair was catalogued. It also echoes the deadline mechanics behind CISA's Sept. 25 SharePoint addition, where a vendor's own severity rating shifted weeks after the underlying fix had already shipped.

What to do now

Zyxel's fixed firmware has been available since June 16, more than two months before GreyNoise says the campaign began. Administrators who cannot update immediately should confirm their switch's web interface is not reachable from outside the local network and should replace any password still set to the factory default, the condition GreyNoise found on more than half of the compromised devices. CISA's Sept. 24 deadline binds only federal civilian agencies, and GreyNoise had not reported the campaign stopping as of its Sept. 22 update.