The GS1900 in the closet is on CISA's list, and Thursday is the federal clock

CISA put a cheap managed switch on the exploited list yesterday. CVE-2026-7273 is a hole in the Zyxel GS1900 series: a LAN user with no login can send the web CGI a request that becomes a command on the box. Zyxel shipped firmware in June. CISA's federal clock is Thursday, September 24. GreyNoise says someone has already used it. Nearly a thousand switches, forty-eight countries, configs and hashed admin passwords walking out. The switch in the contractor closet is not furniture. It is a computer with a management page.

What hit the GS1900

Zyxel's June advisory called it a stack overflow in the CGI program. Unauthenticated, on the LAN, over HTTP. They patched the models still in vulnerability support: GS1900-8, 8HP, 10HP, 16, 24, 24E, 24EP, 24HPv2, 48, and 48HPv2. The fixed builds are the 2.90(...2)C0 line. Anything on 2.90(...1)C0 or earlier in that table is open. Models not on the table, Zyxel said, are outside this one.

GreyNoise dated the first public use to last Thursday and the collection to 996 boxes as of their Monday note. They described a suspected Chinese-speaking actor, overlapping the Red Heron cluster Acronis tied to a Gitea hole last week. CISA has not published its own attack write-up. Zyxel has not updated the June page to say "used." The KEV row is the official sentence. BOD 26-04 gives civilian federal agencies until Thursday. Canadian shops do not get a letter. They get the same firmware table.

Why this is a yard and office problem

GS1900s show up as the eight-port PoE brick under a reception desk, the 24-port in a conex, the switch a telco left behind. Management is "on the LAN," which people hear as safe. Guest Wi-Fi that lands on the same VLAN, a contractor laptop, a camera that was never segmented: that is the LAN. A stolen config is the VLAN map, the uplink, and the password hash for the next visit. Digital Watchdog last week, Netcore yesterday, Zyxel today. Same class of device. Different logo.

Zyxel still has a pile of older holes on the KEV list. CISA is tracking more than a dozen across their routers, switches, firewalls, and NAS. February they told customers to replace end-of-life routers rather than wait for a patch. If your GS1900 is still on a 2.10-era build because "it just works," you are in the firmware range GreyNoise said the actor could aim at.

What we would do before Thursday

• Inventory GS1900 by the sticker and the web banner, not by "the ports light up." Write the model and the 2.90 build. Move to the matching (...2)C0 from Zyxel's June table.
• Take the management page off guest VLANs and off the internet. LAN-only in the advisory still means anyone on that LAN.
• If the box was reachable from somewhere it should not have been, treat the config as spilled. Change admin passwords after the firmware, and do not reuse the old hash.
• Do not download a test script to "see if it works." The KEV row is enough. The June firmware is the fix.

Bottom line

A smart switch with a June patch and a Thursday clock is still a Thursday job if you have not applied it. Forensic Five will ask which closet the GS1900 lives in and whether the management page is on the same LAN as the coffee Wi-Fi. From St. Albert, Alberta. Flash the (...2)C0. Then look at the next unmanaged brick.