Summary
- GreyNoise attributed 996 compromised GS1900 switches across 48 countries to activity exploiting CVE-2026-7273.
- Zyxel describes the flaw as a LAN-based, unauthenticated stack buffer overflow capable of leading to operating-system command execution.
- CISA has added CVE-2026-7273 to its Known Exploited Vulnerabilities catalogue, confirming evidence of exploitation.
An attacker compromised 996 Zyxel GS1900 switches across 48 countries using a vulnerability the vendor patched in June, according to threat-intelligence analysis from GreyNoise.
The campaign involved CVE-2026-7273, a stack-based buffer overflow in the CGI component of GS1900 series switch firmware. Zyxel’s own advisory says a LAN-based, unauthenticated attacker can potentially execute operating-system commands by sending a crafted HTTP request to an affected device.
GreyNoise attributed 996 compromised switches to the activity and reported affected devices across a broad geographic spread, including Italy, France, the Netherlands, the Czech Republic, and the UK. Italy was one of the countries with the largest recorded concentrations.
The figures are GreyNoise telemetry rather than a count published by Zyxel or a government agency and should be read on that basis. The US Cybersecurity and Infrastructure Security Agency has separately added CVE-2026-7273 to its Known Exploited Vulnerabilities catalogue, establishing that exploitation of the vulnerability has been observed.
Zyxel disclosed and patched the flaw on 16 June. Its advisory covers several GS1900 models and firmware branches, with fixed releases published for devices still within the company’s vulnerability-support period.
The gap between the June patch and later exploitation illustrates a familiar problem for network infrastructure. Switches can remain in service for years and may receive less routine operational attention than desktop or server software, particularly in smaller environments where networking hardware is installed and then largely left alone.
GreyNoise reported that configuration data, network information, and hashed root credentials were collected during the campaign. It also said 564 of the compromised devices were still using factory-default credentials.
The default-credential finding does not explain CVE-2026-7273 itself, but it adds another weakness around devices that had already been reached. Once an attacker can inspect infrastructure configuration and administrative material, the value of the compromised switch extends beyond the vulnerability used for initial execution.
Network switches occupy a useful position for reconnaissance. Configuration can expose addressing, local topology, management settings, and other information capable of helping an attacker understand how a network is organised.
GreyNoise assessed the operator as Chinese-speaking. That remains a research attribution rather than a government finding, and the available evidence does not establish that the campaign was state-directed or identify a specific organisation behind it.
The observed compromise of devices in multiple European countries gives the campaign broader relevance than the US federal remediation deadline attached to the CISA catalogue. The affected hardware is used in office, education, hospitality, retail, and other smaller enterprise environments where managed switches may form a relatively static part of the local network.
The incident also shows why publication of a patch does not by itself close a vulnerability. Exploitation observed months after the vendor fix indicates that a measurable population of devices remained exposed long enough for an attacker to operationalise the flaw.
The number of compromised switches does not establish how many separate organisations were affected or whether each device became a platform for further intrusion. The reported extraction of configuration and credential material nevertheless means the campaign extends beyond unsuccessful scanning or proof-of-concept activity.
