CVE-2026-7273: Buffer Overflow
A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict access to the device's management HTTP/CGI interface to trusted management hosts or networks (for example, place the Zyxel GS1900-48HPv2 on a management VLAN and enforce ACLs/firewall rules or IP allowlists) to prevent unauthenticated LAN hosts from sending crafted HTTP requests.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7273?
The severity of CVE-2026-7273 is classified as high, with a score of 8.8.
How do I fix CVE-2026-7273?
To fix CVE-2026-7273, users should update the Zyxel GS1900-48HPv2 firmware to version 2.90(ABTQ.1)C0 or later.
What type of vulnerability is CVE-2026-7273?
CVE-2026-7273 is a stack-based buffer overflow vulnerability found in the CGI program of specific Zyxel switch firmware.
Who is affected by CVE-2026-7273?
CVE-2026-7273 affects users of Zyxel GS1900-48HPv2 switches running firmware versions prior to 2.90(ABTQ.1)C0.
Can CVE-2026-7273 be exploited remotely?
CVE-2026-7273 can be exploited by a LAN-based, unauthenticated attacker who sends a crafted HTTP request.