Office Switches on the KEV List: Zyxel GS1900 CVE-2026-7273 and What to Ask Your MSP

Switches are the furniture of the network — until someone can take them over from the office LAN. Many small offices and branch sites still run Zyxel GS1900 series switches. They are common, affordable, and easy to forget after install day.

On September 21, 2026, CISA added CVE-2026-7273 — a stack-based buffer overflow in Zyxel GS1900 series switches — to the Known Exploited Vulnerabilities (KEV) catalog based on evidence of active exploitation. Zyxel’s June 16, 2026 advisory describes the issue in the CGI program of GS1900 firmware: a LAN-based, unauthenticated attacker can send a crafted HTTP request and potentially execute OS commands.

Owner translation: If an attacker is already on your local network — guest Wi-Fi slip, compromised laptop, bad cable in a conference room — an unpatched GS1900 management interface can become a command-execution problem. CISA listed it because exploitation is real. Firmware updates are the ticket.

What Zyxel and CISA Confirmed

• Vulnerability: Stack-based buffer overflow in GS1900 CGI; LAN-based unauthenticated OS command execution via crafted HTTP.
• Affected models (per Zyxel table): GS1900-8, 8HP, 10HP, 16, 24, 24E, 24EP, 24HPv2, 48, 48HPv2 — generally firmware 2.90(….1)C0 and earlier on listed trains.
• Fixed firmware: Matching 2.90(….2)C0 releases for each model (for example GS1900-8 → 2.90(AAHH.2)C0). Zyxel notes on-market products not in the table remain unaffected.
• KEV signal: CISA encourages all organizations — not only federal agencies under BOD 26-04 — to prioritize remediation of KEV catalog vulnerabilities.

Why This Hits Everyday SMB Networks

• LAN-only is not “safe.” Guest networks, contractors, malware on a user PC, and flat VLANs all put attackers on the same LAN as switch management.
• Switches see everything. A compromised switch can weaken segmentation stories you tell insurers and customers.
• Firmware debt is common. “It still passes traffic” is not a patch policy.
• MSP-managed does not mean auto-updated. You still need written model, version, and upgrade date.

The Ticket I Want Owners to Send Today

“Please confirm whether we use any Zyxel GS1900 series switches. If yes: list each model and current firmware, confirm upgrade to the fixed 2.90(.2)C0 release from Zyxel’s June 16, 2026 advisory for CVE-2026-7273, confirm management interfaces are not reachable from guest or untrusted VLANs, and note any unusual admin logins or config changes since CISA’s September 21, 2026 KEV addition. If we do not use GS1900, name the switch brands/models we do use and their current firmware / last patch dates for actively exploited flaws.”

How This Fits Everyday Risk Triage

KEV entries are a prioritization signal. Pair this ticket with a simple switch inventory so the next network-gear KEV does not start from zero. Restrict management access to trusted admin networks while you schedule the firmware window.

Need a calm second opinion on switch exposure or vendor evidence for insurance? CyberIntelPro / Security Medic works MSP-safe with Hudson Valley SMBs and their partners.

References

1. CISA, “CISA Adds One Known Exploited Vulnerability to Catalog” (Sep 21, 2026) — CVE-2026-7273: cisa.gov/…/2026/09/21/…
2. Zyxel, Security advisory for stack-based buffer overflow in GS1900 series switches (Jun 16, 2026): zyxel.com/…/gs1900…
3. NVD, CVE-2026-7273: nvd.nist.gov/vuln/detail/CVE-2026-7273
4. CISA Known Exploited Vulnerabilities Catalog: cisa.gov/known-exploited-vulnerabilities-catalog