CVE-2026-7273NVD

Vulnerability Summary

A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.

Severity Level

HIGH(8.8)

Published Date

Jun 16, 2026

Last Modified

Sep 22, 2026

Exploitation Status

ACTIVE

EPSS Score (30-Day)

2.50%Probability

Root Weakness (CWE)

CWE-121: Unknown/Unlisted Weakness ↗

Refer to the official MITRE database for detailed architectural specifications regarding this weakness.

CVSS v3.1 Base Metrics — Score 8.8 (HIGH)

Attack VectorAdjacent

Attack ComplexityLow

Privileges RequiredNone

User InteractionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

Affected & Patched Versions

Affected Versions

Zyxel Gs1900-8 Firmware < 2.90\(aahh.2\)c0
Zyxel Gs1900-8hp Firmware < 2.90\(aahi.2\)c0
Zyxel Gs1900-10hp Firmware < 2.90\(aazi.2\)c0
Zyxel Gs1900-16 Firmware < 2.90\(aahj.2\)c0
Zyxel Gs1900-24 Firmware < 2.90\(aahl.2\)c0
Zyxel Gs1900-24e Firmware < 2.90\(aahk.2\)c0
Zyxel Gs1900-24ep Firmware < 2.90\(abto.2\)c0
Zyxel Gs1900-24hpv2 Firmware < 2.90\(abtp.2\)c0
Zyxel Gs1900-48 Firmware < 2.90\(aahn.2\)c0
Zyxel Gs1900-48hpv2 Firmware < 2.90\(abtq.2\)c0

Patched Versions

Zyxel Gs1900-8 Firmware 2.90\(aahh.2\)c0
Zyxel Gs1900-8hp Firmware 2.90\(aahi.2\)c0
Zyxel Gs1900-10hp Firmware 2.90\(aazi.2\)c0
Zyxel Gs1900-16 Firmware 2.90\(aahj.2\)c0
Zyxel Gs1900-24 Firmware 2.90\(aahl.2\)c0
Zyxel Gs1900-24e Firmware 2.90\(aahk.2\)c0
Zyxel Gs1900-24ep Firmware 2.90\(abto.2\)c0
Zyxel Gs1900-24hpv2 Firmware 2.90\(abtp.2\)c0
Zyxel Gs1900-48 Firmware 2.90\(aahn.2\)c0
Zyxel Gs1900-48hpv2 Firmware 2.90\(abtq.2\)c0

🎁7-Day Free Trial — Try Pro or Team, no card required.

📧Email Delivery — Threat intel straight to your inbox.

♾️Unlimited Vendors — Track your entire stack.

🚨All New CVEs — Be the first to know.

📈EPSS Spike Alerts — Catch rising risk before it peaks.

🎯Custom EPSS/CVSS — Filter noise, focus on risk.

🛡️Exploit Intel — A 2nd confirmed-exploit signal beyond KEV.

🐙GitHub Issues — Auto-tracked, no duplicates.

📬Weekly Digest — One clean summary, not inbox spam.

🏷️Watchlist Groups — Tag alerts by team (Infra/AppSec/SOC).

💬Webhooks — Slack & Teams integration.

🔀Smart Routing — Critical alerts to one channel, rest to another.

🚫Ad-Free — Uninterrupted experience.