Zyxel GS1900 Switches CVE-2026-7273

The attacker must have Layer-2 reachability to the switch's HTTP/HTTPS web management interface (AV:A - adjacent network), meaning a foothold on the same VLAN or broadcast domain as the management IP; routed Internet access is not sufficient. No authentication is required (PR:N) and no user interaction is needed (UI:N), so any device able to send a TCP connection to the CGI listener can attempt the overflow. Exploitation is limited to GS1900 series models running firmware at or below 2.90(ABTQ.1)C0 with the web management service enabled - deployments that have disabled HTTP/HTTPS management or that segregate management to an isolated VLAN unreachable by user devices are not exposed.

The CVSS 3.1 vector decomposes to AV:A (adjacent - exploitation requires LAN reachability, not Internet), AC:L, PR:N (no authentication), UI:N, with full CIA impact - yielding 8.8 High. The description's 'LAN-based, unauthenticated' phrasing matches AV:A/PR:N cleanly and is internally consistent. There is no KEV listing, no EPSS score, and no SSVC decision provided, and no POC has surfaced publicly at the time of analysis, so real-world risk is currently driven by exposure rather than confirmed exploitation. The practical risk is high in any environment where untrusted users, guest VLANs, or compromised endpoints share a broadcast domain with switch management interfaces - common in flat SMB networks the GS1900 line targets - but considerably lower where management is isolated on a dedicated VLAN reachable only by administrators.

An attacker who gains a foothold on any host in the same Layer-2 broadcast domain as a GS1900 switch - for example, by compromising a VoIP phone, printer, or guest laptop - sends a single crafted HTTP request to the switch's web management CGI. The oversized parameter overflows a stack buffer in the request parser, hijacks control flow, and executes attacker-supplied OS commands as root on the switch, enabling persistent backdoors, mirroring of traffic to attacker ports, or pivoting deeper into the network. No public exploit identified at time of analysis, but the bug class and unauthenticated nature make weaponization straightforward once firmware diffing reveals the vulnerable handler.