Update Zyxel GS1900 switches: an exploited flaw lets attackers on your network take over
CISA added a Zyxel GS1900 switch flaw to its exploited list on September 21. It's reachable from inside your network, not the internet, but it's being used. Here's the firmware for each model.
Zyxel GS1900 series switches are common in small offices. A buffer overflow in the switch’s web management program can let an unauthenticated attacker on your local network run operating system commands on the switch. CISA added it to its Known Exploited Vulnerabilities catalog on September 21, 2026.
Why it matters even though it’s “local only”
This flaw can’t be reached from the internet by itself. An attacker needs to already be on your network. But that’s exactly what happens after a phishing email or a compromised PC, and a taken-over switch can give an attacker a foothold on your network that’s easy to overlook.
Fixed firmware by model
Zyxel released patches for these models (listed in Zyxel’s June 2026 advisory):
| Model | Affected firmware | Update to |
|---|---|---|
| GS1900-8 | 2.90(AAHH.1)C0 and earlier | 2.90(AAHH.2)C0 |
| GS1900-8HP | 2.90(AAHI.1)C0 and earlier | 2.90(AAHI.2)C0 |
| GS1900-10HP | 2.90(AAZI.1)C0 and earlier | 2.90(AAZI.2)C0 |
| GS1900-16 | 2.90(AAHJ.1)C0 and earlier | 2.90(AAHJ.2)C0 |
| GS1900-24 | 2.90(AAHL.1)C0 and earlier | 2.90(AAHL.2)C0 |
| GS1900-24E | 2.90(AAHK.1)C0 and earlier | 2.90(AAHK.2)C0 |
| GS1900-24EP | 2.90(ABTO.1)C0 and earlier | 2.90(ABTO.2)C0 |
| GS1900-24HPv2 | 2.90(ABTP.1)C0 and earlier | 2.90(ABTP.2)C0 |
| GS1900-48 | 2.90(AAHN.1)C0 and earlier | 2.90(AAHN.2)C0 |
| GS1900-48HPv2 | 2.90(ABTQ.1)C0 and earlier | 2.90(ABTQ.2)C0 |
Zyxel says on-market models not listed aren’t affected. Models past their support period may not get a patch, so if yours isn’t in the table and is old, plan to replace it.
Also worth doing
- Limit who can reach the switch’s management page. Put switch management on a separate management network or VLAN, instead of the same network as everyone’s PCs.
- Change default passwords on every switch, and keep firmware updates on your regular maintenance list. Switches are easy to forget.
Sources
- Zyxel security advisory for stack-based buffer overflow vulnerability in GS1900 series switches (Zyxel): the vulnerability, affected models and firmware, and patches
- Known Exploited Vulnerabilities catalog (CISA): CVE-2026-7273 added September 21, 2026
Get new guides by email
Plain-English tech tips, scam and security alerts, and fixes for small offices, whether you're the office manager or the IT pro. No spam, and you can unsubscribe anytime.