CVE-2026-7273: A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2

Synopsis

A stack-based buffer overflow exists in the CGI web interface of Zyxel GS1900-series managed switch firmware, affecting multiple models through version 2.90. An attacker on the same local network segment (LAN, VLAN, or adjacent network) can send a crafted HTTP request without any credentials to trigger the overflow. Successful exploitation gives the attacker the ability to execute arbitrary OS commands on the switch, with full read, write, and availability impact. No vendor patch has been published yet; HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must be on an adjacent network (LAN, VLAN, or VPN segment) to reach the switch's CGI interface; remote internet-based exploitation is not possible without prior access to the local network.

• AuthenticationNot required

  No credentials of any kind are needed; the vulnerable CGI endpoint accepts unauthenticated HTTP requests.

• Victim interactionNot required

  Exploitation is entirely attacker-driven; no user action or interaction from anyone on the target device is required.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special preconditions, race conditions, or environmental tuning beyond network adjacency.

Blast Radius

• Executes arbitrary OS commands on the switch with the privilege level of the CGI process, giving the attacker full control over switch configuration and management functions.
• Reads sensitive data stored on the device, including credentials, SNMP community strings, VLAN configurations, and management interface settings.
• Modifies switch configuration, including routing tables, port assignments, and access-control lists, enabling traffic interception or network segmentation bypass.
• Crashes or reboots the switch, disrupting network connectivity for all devices dependent on that segment.