Posted on

Zyxel GS1900 CVE-2026-7273 – Active Unauthenticated OS Command Execution

Threat Overview

CISA added CVE-2026-7273 to the Known Exploited Vulnerabilities catalog on September 21, 2026. The flaw is a stack-based buffer overflow in the CGI program of Zyxel GS1900 series switch firmware. A LAN-adjacent unauthenticated attacker can send a crafted HTTP request and potentially execute operating-system commands. GreyNoise reports a suspected Chinese-speaking actor weaponized the flaw beginning August 17 and successfully exploited and exfiltrated data from 996 switches across 48 countries. Observed post-exploitation included TFTP retrieval and execution of a custom collector that gathered configurations, hashed root credentials, and network information.

References

Impacted Systems

Zyxel GS1900 smart managed switches on affected 2.90 firmware builds. Fixed firmware is available for the impacted GS1900-8, 8HP, 10HP, 16, 24, 24E, 24EP, 24HPv2, 48 and 48HPv2 models. Exploitation is LAN-based and unauthenticated.

Why this matters

Managed switches are high-value infrastructure. Confirmed exploitation has produced configuration and credential theft at significant scale, providing attackers network intelligence and potential persistence or pivot opportunities.

Exploitation Status

CISA confirms active exploitation. GreyNoise reports exploitation since August 17, 2026 and attributes the observed cluster as suspected Chinese-speaking activity. Zyxel had not updated its original advisory to confirm exploitation at the time of reporting.

What this hunt looks for

Unusual switch management access, TFTP activity, configuration and credential export behavior, new management sources, and unusual network connections involving managed-switch addresses.

Required logs

Network-device Syslog, firewall or network telemetry in CommonSecurityLog, and switch management logs where available.

First Pass – TFTP Activity From Network Devices

Syslog
| where TimeGenerated >= ago(30d)
| where SyslogMessage has_any ("tftp","TFTP")
| project TimeGenerated,Computer,HostName,ProcessName,SeverityLevel,SyslogMessage
| order by TimeGenerated desc

Zyxel Management HTTP Activity

CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where DestinationPort in (80,443)
| where DeviceVendor has "Zyxel" or DeviceProduct has "GS1900"
| project TimeGenerated,SourceIP,DestinationIP,DestinationPort,RequestMethod,RequestURL,DeviceAction,Message
| order by TimeGenerated desc

TFTP Network Connections

CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where DestinationPort == 69 or SourcePort == 69
| project TimeGenerated,SourceIP,DestinationIP,SourcePort,DestinationPort,Protocol,DeviceAction,Message
| order by TimeGenerated desc

New Sources Accessing Switch Management

let Baseline=CommonSecurityLog
| where TimeGenerated between (ago(30d)..ago(2d))
| where DestinationPort in (80,443,22)
| summarize by SourceIP,DestinationIP;
CommonSecurityLog
| where TimeGenerated >= ago(2d)
| where DestinationPort in (80,443,22)
| join kind=leftanti Baseline on SourceIP,DestinationIP
| project TimeGenerated,SourceIP,DestinationIP,DestinationPort,DeviceAction,Message
| order by TimeGenerated desc

Switch Configuration and Credential Terms

Syslog
| where TimeGenerated >= ago(30d)
| where SyslogMessage has_any ("configuration","config","backup","export","root","password","credential")
| where SyslogMessage has_any ("GS1900","Zyxel","tftp")
| project TimeGenerated,Computer,HostName,ProcessName,SyslogMessage
| order by TimeGenerated desc

Network Device Connections to New External IPs

let Known=CommonSecurityLog
| where TimeGenerated between (ago(30d)..ago(2d))
| summarize by SourceIP,DestinationIP;
CommonSecurityLog
| where TimeGenerated >= ago(2d)
| join kind=leftanti Known on SourceIP,DestinationIP
| project TimeGenerated,SourceIP,DestinationIP,DestinationPort,Protocol,DeviceAction,Message
| order by TimeGenerated desc

High-Rate HTTP Requests to Management Interfaces

CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where DestinationPort in (80,443)
| summarize Requests=count() by SourceIP,DestinationIP,bin(TimeGenerated,5m)
| where Requests >= 50
| order by Requests desc

Detection Notes

Switch telemetry is frequently sparse. TFTP is directly tied to reported post-exploitation behavior but is not specific to CVE-2026-7273. CommonSecurityLog fields depend on the network/firewall parser. Without switch management logs or network telemetry, Sentinel may have little visibility into exploitation occurring entirely within the LAN.

Leave a comment