CISA Adds Zyxel GS1900 Command Execution Flaw to KEV
Tech GuruQuick Answer
CVE-2026-7273 is known exploited: CISA added the Zyxel GS1900 flaw to KEV on September 21, 2026. A LAN-based unauthenticated attacker can use a crafted HTTP request against the vulnerable CGI program to execute operating-system commands. Match the switch model to Zyxel's patched firmware; the catalog's September 24 remediation deadline has passed.
Confirm Scope And Apply The Supported Fix
What to do now: Identify affected GS1900 models, restrict access to their management interfaces, preserve relevant logs for triage, and install the exact model-specific firmware. Covered federal agencies should follow the KEV entry's BOD 26-04 requirements, including exposure assessment and forensic triage.
Open the CISA KEV Catalog and Zyxel's model-specific firmware advisory.
Source check: 2026-10-02 UTC. This notice reflects the primary-source evidence described below, not a completed update or exploitation test. Recheck the advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Zyxel GS1900-8, -8HP, -10HP, -16, -24, -24E, -24EP, -24HPv2, -48, and -48HPv2 switches |
|---|---|
| Advisory | CISA KEV: CVE-2026-7273 |
| CVE | CVE-2026-7273 |
| Authoritative release date | Zyxel advisory: 2026-06-16. CISA KEV addition: 2026-09-21. |
| Authority revision date | No separate vendor revision time established. The former 2026-09-21 timestamp is not supported as Zyxel's advisory publication or revision time. |
| Affected versions | The listed GS1900 models at firmware 2.90(*.1)C0 and earlier, using each model's Zyxel firmware code; the attack is LAN-based and unauthenticated. |
| Fixed version | Zyxel fixed firmware: GS1900-8: 2.90(AAHH.2)C0GS1900-8HP: 2.90(AAHI.2)C0GS1900-10HP: 2.90(AAZI.2)C0GS1900-16: 2.90(AAHJ.2)C0GS1900-24: 2.90(AAHL.2)C0GS1900-24E: 2.90(AAHK.2)C0GS1900-24EP: 2.90(ABTO.2)C0GS1900-24HPv2: 2.90(ABTP.2)C0GS1900-48: 2.90(AAHN.2)C0GS1900-48HPv2: 2.90(ABTQ.2)C0 |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | Known exploited: CISA KEV addition 2026-09-21; due date 2026-09-24; forensic triage Yes. Ransomware use is Unknown, not confirmed absent. KEV inclusion does not establish that a particular switch has been compromised. |
What Changed
Zyxel published its firmware advisory on June 16, 2026; the September event was CISA's KEV addition, not the original vendor disclosure. CISA also marks forensic triage as required. A firmware update and an investigation for possible compromise are separate tasks.
What To Validate Now
- Inventory. Record exact switch model, full firmware code, management-interface reachability, owner and recovery access before changing firmware.
- Establish applicability. Compare each deployment with the authority's affected-version statement: The listed GS1900 models at firmware 2.90(*.1)C0 and earlier, using each model's Zyxel firmware code; the attack is LAN-based and unauthenticated. Do not infer applicability from product family or severity alone.
- Remediate. Use the firmware file for the exact model and code in the fixed-version table, following Zyxel's upgrade procedure. Do not interchange images between models with similar names.
- Validate. Read back the full firmware string from each switch after the approved restart, then verify management access, VLANs, uplinks and any required PoE behavior. Keep triage findings separate from evidence that the firmware installation succeeded.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Treat LAN reachability as an attack prerequisite, not assurance that the device is safe. Preserve evidence before disruptive changes where feasible, coordinate patching with incident response, and test the recovery plan. CISA's BOD 26-04 and forensic-triage guidance govern the catalog action for covered agencies.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
