CISA’s Federal Zyxel Deadline Passed. The Intrusion Review Still Matters.

Update, 31 October 2026: The vendor’s advisory, first released on 16 June, provides ten model-specific corrected firmware builds. The table below separates each affected build ceiling from its fixed release. Installing the right image addresses the software flaw; it does not establish that a switch escaped the earlier exploitation.

CVE-2026-7273 is a stack-based buffer overflow in the switches’ CGI program. CISA says a LAN-based, unauthenticated attacker can send a crafted HTTP request and may be able to execute operating-system commands.

The perimeter is not the only exposure boundary

A switch does not have to expose its management interface directly to the internet to be at risk. Any compromised workstation, unmanaged device, guest network, remote-access session or poorly segmented administration host may give an attacker the local position needed to reach it.

In its 21 September report, GreyNoise describes exploitation on or about 17 August and collection from 996 Zyxel switches in 48 countries, including configurations, networking information and hashed root credentials. Of that observed set, 564 retained factory-default credentials. These are the researchers’ observed devices, rather than a complete victim count or the full campaign size. The observations predate CISA’s catalogue addition; they are not a new 31 October census.

CISA’s entry marks ransomware use as unknown and requires forensic triage. It does not name an actor, publish a universal indicator set or say that every GS1900 device is reachable in the same way.

Ten models have ten matching firmware rows

Zyxel’s security advisory lists patches for the following models within its vulnerability-support programme. Each affected version below includes that build and earlier firmware for the same model. A similar model name does not establish an interchangeable image.

The official CVE record rates the issue 8.8 under CVSS 3.1, with adjacent-network access, no required privileges and no user interaction. The vendor says unlisted on-market products are unaffected; that statement does not establish the status of every obsolete or regional model. Obtain model-specific guidance if a device is outside the listed support scope.

GreyNoise recovered a Python exploit whose explicit target was the GS1900-24 running firmware in the 2.10 to 2.90 range. Its configurable targeting options are not proof that every listed model was successfully attacked. The researchers’ evidence reinforces the need to examine management requests and retained configuration data, rather than treating a firmware update as a retrospective clean bill of health.

Match the exact model, then review the vulnerable period

• Find every GS1900 switch. Include branch sites, labs, temporary deployments and devices administered by local teams rather than central networking.
• Record the exact model and firmware. Use Zyxel’s advisory to match each device to the fixed release rather than assuming that a nearby model number has the same status. Install the applicable update, then verify the running firmware and intended configuration.
• Restrict the management plane. Permit access only from dedicated administration networks and named management systems.
• Review the vulnerable period. Look for unexpected HTTP requests to the management interface, configuration changes, new accounts, command execution and outbound connections from the switch.
• Preserve evidence before rebuilding. Export the running configuration, logs and relevant network telemetry when compromise is suspected.
• Rotate exposed secrets. Credentials, SNMP communities, API keys and certificates held by a compromised switch should be treated as potentially exposed.

The federal deadline is not automatically a legal deadline for every organisation. Active exploitation is still a reason to treat CVE-2026-7273 as an incident-response question as well as a patching task.

Sources

• CISA Known Exploited Vulnerabilities catalogue, entry added 21 September 2026 with a 24 September due date.
• Zyxel security advisory for affected GS1900 models and fixed firmware.
• GreyNoise threat report, published 21 September 2026, describing the earlier August observations.
• Official Zyxel CNA record, published 16 June 2026 at 02:20:29.847 UTC; ten affected model groups and the separate CVSS assessment.