Source: cisa.gov
A stack-based buffer overflow vulnerability (CVE-2026-7273) has been identified in Zyxel GS1900 series switches within the CGI program. The flaw allows a LAN-based, unauthenticated attacker to potentially execute OS commands by sending a crafted HTTP request. The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog and is subject to BOD 26-04 remediation requirements. Zyxel has published a security advisory with details and patch information. The vulnerability requires no authentication, lowering the bar for exploitation significantly. Organizations using GS1900 series switches on their networks should prioritize patching immediately. CISA has also outlined forensic triage requirements for affected systems under BOD 26-04 implementation guidance.
