Zyxel GS1900 CVE-2026-7273: 996 Switches Compromised for Data Theft, Patch by Thursday

The Zyxel GS1900 web management interface runs a CGI program on port 80 (HTTP) and port 443 (HTTPS) to handle administrative requests. CVE-2026-7273 is triggered when the CGI program receives an HTTP POST request containing field values that exceed the size of the receiving stack buffer. The program copies the attacker's input without checking the input length, overwriting the saved return address on the stack. When the CGI function returns, execution jumps to the attacker's payload rather than to the legitimate caller.

The attack requires no credentials. Any host on the local area network that can reach the switch management interface can send the exploit request. The CGI program runs with root privileges, so successful exploitation gives the attacker full OS-level control of the switch: read access to the running configuration, the ability to modify routing tables, VLAN assignments, and ACLs, and the ability to read hashed passwords for all management accounts.

The confirmed exploit delivery mechanism is a Python script protected by PyArmor, a commercial Python code obfuscation tool. PyArmor wraps the Python bytecode in a proprietary runtime that makes static analysis difficult without reverse engineering the obfuscation layer. The script automates the exploit, exfiltrates switch configuration data, network topology information, and hashed root credentials over an outbound connection to attacker-controlled infrastructure, and then exits cleanly to minimize the detection window.

The attack does not require any user interaction on the switch. The exploited interface is the web management CGI, not an administrative session. A switch left on its factory configuration with the management VLAN accessible from user network segments has zero defense against this attack without the firmware patch.

See also: the MikroTik RouterOS CVE-2026-67276 SSH authentication bypass for a parallel case of unauthenticated access to network device management planes enabling downstream credential theft.

All ten Zyxel GS1900 models are vulnerable if running firmware version 2.90(XXXX.1)C0 or earlier. The affected models are the GS1900-8, GS1900-8HP, GS1900-10HP, GS1900-16, GS1900-24, GS1900-24E, GS1900-24EP, GS1900-24HPv2, GS1900-48, and GS1900-48HPv2. Each model's vulnerable firmware version uses a model-specific code in the (XXXX) field, all sharing the same buffer overflow flaw in the CGI component.

The GS1900 series is marketed toward small to mid-size organizations: offices, schools, hotels, and retail environments. These are not perimeter appliances. They sit at the access layer of the internal network, handling user device connectivity. That deployment context is the reason 564 of the 996 compromised switches had factory default credentials: organizations treat these switches as infrastructure, not as security-sensitive systems requiring active credential management.

The attacker exfiltrated three categories of data from each compromised switch. Device configuration data exposes the complete network design: VLAN assignments, port configurations, spanning tree topology, link aggregation groups, and access control lists. Network information maps the broader topology: neighboring devices, management IP schemes, and routing relationships. Hashed root-level credentials give the attacker persistent access material that can be cracked offline for reuse in subsequent attacks.

Geographic distribution of confirmed victims spans 48 countries, with the highest concentrations in Italy, the United States, Taiwan, South Korea, and multiple EU member states. The campaign started August 17, 2026, approximately two months after Zyxel released the patch on June 16. Every device compromised in this campaign was running a version of the firmware that had a publicly available, vendor-supplied fix for more than 60 days before exploitation began.

GreyNoise Intelligence attributed the CVE-2026-7273 exploitation campaign to a Chinese-speaking threat actor with a documented pattern of mass-scanning campaigns against network device management interfaces. The same group has previously targeted WordPress sites exploiting CVE-2026-63030 and CVE-2026-60137, and Gitea repository servers exploiting CVE-2026-60004. The use of PyArmor for exploit obfuscation is consistent across all three campaigns, providing a behavioral fingerprint for attribution.

The attacker's operational pattern prioritizes scale over stealth during the initial data collection phase. The PyArmor Python script automates the entire exploit, exfiltration, and exit cycle to maximize the number of devices that can be hit in a short campaign window. The data collected (device configurations, network maps, and hashed credentials) is consistent with intelligence-gathering objectives: mapping target organization network infrastructure as a precursor to more targeted access operations, or selling network topology data and management credentials to other threat actors.

The 564 switches with factory default credentials represent a secondary access vector independent of the buffer overflow. Even if the CVE-2026-7273 exploit had not been used, those devices were accessible through direct authentication with factory defaults. The campaign likely used the buffer overflow for devices with changed credentials, and direct credential authentication for the remaining 564 devices, maximizing compromise coverage across the unpatched device population.

GreyNoise retained one attacker IP address from public disclosure "due to victim sensitivities and operational risk," with a commitment to release it once those concerns are resolved. The redacted IP represents the primary command and control infrastructure observed during the active exfiltration phase. A second IP associated with initial exploitation probing was made available in the GreyNoise IOC feed.

See also: Cisco ISE CVE-2026-76460 authentication bypass for the pattern of Chinese and other state-linked actors prioritizing network authentication infrastructure as data theft and pivot targets.

No real-time network IOCs (specific C2 IP addresses or domain names) have been publicly released for the CVE-2026-7273 campaign as of September 22, 2026. GreyNoise has confirmed one attacker IP but withheld it pending victim notification. Check the GreyNoise CVE-2026-7273 tag for current attacker IPs as they are released.

The indicators below are behavioral and structural, derived from the confirmed attack mechanics. Deploy them proactively in your network monitoring and EDR stack while applying the firmware patch.

The highest-confidence indicator of active exploitation is an unexpected outbound network connection originating from a Zyxel GS1900 switch management IP to an external destination. Under normal operating conditions, GS1900 switches initiate no outbound connections to external IPs. Any outbound connection from a switch management IP to port 80, 443, 22, or 21 on an external address should be treated as a strong indicator of compromise.

On the attacker's workstation (the machine running the PyArmor exploit script), process creation events for Python with command line arguments containing "pytransform" or "_pytransform" are a behavioral indicator of PyArmor-protected exploit execution. Endpoint detection platforms monitoring process creation will capture this artifact when the exploit script runs from an internal host.

To check whether a GS1900 switch has been compromised: log in to the management interface, navigate to the system log, and look for unexpected configuration read operations, outbound connection attempts, or authentication events outside normal administrative windows. Compare the running configuration against your baseline to identify unauthorized changes to VLAN assignments, ACLs, or management credentials.

These rules detect CVE-2026-7273 exploitation activity across the two most observable stages: the exploit delivery (CGI HTTP POST from an internal host) and the exploit execution on attacker workstations (PyArmor Python runtime). Both carry experimental status; validate against your environment's log sources before deploying automatic blocking.

Every affected GS1900 model has a patched firmware available. The fix corrects the boundary validation failure in the CGI program's input handling routine. Apply the update for your specific model: the (XXXX) segment of the firmware version string is model-specific, but all patched versions increment to 2.90(XXXX.2)C0 from the vulnerable 2.90(XXXX.1)C0. After patching, change all management credentials to ensure that any hashed credentials exfiltrated during the campaign cannot be used for re-entry.