www.zyxel.com Chinese Hackers Exploit Zyxel Switch Vulnerability CVE-2026-7273
Article Content
- •CVE-2026-7273 exploited in 996 Zyxel switches across 48 countries.
- •564 compromised devices used factory default credentials.
- •CISA mandates federal agencies to patch by September 24, 2026.
A Chinese-speaking threat actor has exploited a stack-based buffer overflow vulnerability (CVE-2026-7273) in Zyxel GS1900 switches, compromising 996 devices across 48 countries since August 17, 2026. The vulnerability allows unauthenticated attackers to execute OS commands via crafted HTTP requests. Zyxel released patches for the affected firmware versions in June 2026, but many devices remained unpatched. GreyNoise reported that 564 of the compromised devices were using factory default credentials, increasing their vulnerability. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-7273 to its Known Exploited Vulnerabilities catalog and mandated federal agencies to patch the flaw by September 24, 2026. The threat actor is believed to be linked to previous attacks on WordPress and Gitea instances. The exploit code was found to be heavily obfuscated, complicating detection efforts.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (9)
Following this threat?
Track Red Heron, Rapuncel Stealer and Zyxel in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Critical RCE Vulnerability in Prefab UI Disclosed A critical remote code execution vulnerability, CVE-2026-120338, was disclosed on November 1, 2026, affecting Prefab UI's Generative UI sandbox. The flaw allows attackers to execute arbitrary Python code by exploiting Deno's permissions, enabling file read/write access on the host server. This vulnerability affects… 
Chinese Actor Compromises US Government Networks via PHP2Shell Exploit A suspected Chinese nation-state actor exploited vulnerabilities in Palo Alto Networks firewalls using a chained PHP2Shell exploit and a Linux kernel privilege escalation flaw. The attack, which began on October 23, targeted 25 servers across the US, Japan, Taiwan, and South Korea, with a focus on US…