Tuesday, September 22, 2026

The Exploit Bulletin

2 items require action.

CISA KEV · due 2026-09-24Remote Code ExecutioncriticalCVSS 8.8 CVE-2026-7273

Unauthenticated stack overflow in Zyxel GS1900 switch web CGI yields OS command execution (CVE-2026-7273)

CISA added CVE-2026-7273 to KEV on 2026-09-21 citing evidence of active exploitation, and teams that leave GS1900 switches on 2.90(*.1)C0 or earlier with reachable web management risk an attacker gaining OS-level control of the network edge.

A stack-based buffer overflow in the CGI program of Zyxel GS1900 series switch firmware lets an unauthenticated attacker who can reach the switch's HTTP management interface execute OS commands with a single crafted request. Zyxel describes the attacker as LAN-based, but any GS1900 whose web management is reachable from untrusted networks or the internet is exposed to full device takeover.

Affected: Zyxel GS1900-8 firmware <= 2.90(AAHH.1)C0; Zyxel GS1900-8HP firmware <= 2.90(AAHI.1)C0; Zyxel GS1900-10HP firmware <= 2.90(AAZI.1)C0; Zyxel GS1900-16 firmware <= 2.90(AAHJ.1)C0; Zyxel GS1900-24 firmware <= 2.90(AAHL.1)C0; Zyxel GS1900-24E firmware <= 2.90(AAHK.1)C0; Zyxel GS1900-24EP firmware <= 2.90(ABTO.1)C0; Zyxel GS1900-24HPv2 firmware <= 2.90(ABTP.1)C0; Zyxel GS1900-48 firmware <= 2.90(AAHN.1)C0; Zyxel GS1900-48HPv2 firmware <= 2.90(ABTQ.1)C0

How to Test

Check the firmware version shown in each GS1900's web management interface: any 2.90(xxxx.1)C0 or earlier build on the listed models is vulnerable, while 2.90(xxxx.2)C0 is fixed. Determine whether the switch's HTTP/HTTPS management interface is reachable from the internet or from untrusted VLANs. Review any available web-server or syslog output from the switch for unexpected or malformed HTTP requests to CGI endpoints, unexplained reboots, or configuration changes you did not make; if compromise is suspected, treat the device as untrusted and re-flash from known-good firmware.

How to Patch

Upgrade each model to the fixed firmware Zyxel released on 2026-06-16: GS1900-8 2.90(AAHH.2)C0, GS1900-8HP 2.90(AAHI.2)C0, GS1900-10HP 2.90(AAZI.2)C0, GS1900-16 2.90(AAHJ.2)C0, GS1900-24 2.90(AAHL.2)C0, GS1900-24E 2.90(AAHK.2)C0, GS1900-24EP 2.90(ABTO.2)C0, GS1900-24HPv2 2.90(ABTP.2)C0, GS1900-48 2.90(AAHN.2)C0, GS1900-48HPv2 2.90(ABTQ.2)C0. Until patched, restrict the web management interface to a trusted management network and remove any internet exposure.

Evidence: CISA KEV ↗, VulnCheck KEV ↗, CISA SSVC: active ↗, CISA: added to KEV based on evidence of active exploitation ↗, The Hacker News: Zyxel GS1900 flaw under active exploitation ↗, Canadian Centre for Cyber Security AV26-603 Update 1 ↗, GreyNoise threat signal covering Zyxel switch exploitation ↗

Vendor Advisory: link ↗

Sources: VulnCheck KEV ↗, CISA KEV ↗, greynoise.io ↗, The Hacker News ↗, CISA Advisories ↗, Canadian Centre for Cyber Security ↗

Permalink: /bulletin/2026-09-22/unauthenticated-stack-overflow-in-zyxel-gs1900-switch-web-cgi-yields-cve-2026-7273

Unverified public report · no CVERemote Code Executionhigh

'Click2Shell' CSRF forces theme install and chains to server-side PHP execution, public PoC (WordPress Core)

A complete PoC and technical write-up became public on 2026-09-21, four days after the 7.1.1 fix shipped, and independent analysis from Patchstack has reproduced the chain; sites still on 7.1.0 or earlier with an admin who clicks a link are now exposed to a weaponizable server-side RCE.

Researcher Paulos Yibelo of pwn.ai published full technical details and a proof-of-concept exploit for 'Click2Shell', a cross-site request forgery flaw in WordPress Core 7.1.0 and earlier. A value from a theme-preview URL is parsed differently by the WordPress.org Themes API and by JavaScript in the administrator's browser, letting an attacker with no account, no nonce and no privileges force a site to install any theme from the official WordPress.org catalog. Because an inactive theme can still execute PHP during a Customizer preview, chaining the forced install with a vulnerable catalog theme yields arbitrary PHP execution on the server — enough to read wp-config.php database credentials, create rogue admins, or plant backdoors. The attack does require a logged-in administrator to visit a crafted link (phishing, or via an existing XSS); Author and Editor accounts cannot trigger it. WordPress fixed the flaw in 7.1.1 (released 2026-09-17) by escaping the theme slug and restricting the jQuery selector to real theme cards. No CVE has been assigned yet; pwn.ai says WordPress plans to add one. No exploitation reports are known at this time.

Affected: WordPress Core 7.1.0 and earlier; fixed in 7.1.1

How to Test

Check your version in Dashboard > Updates or with `wp core version`; anything at 7.1.0 or below is affected. Check whether `DISALLOW_FILE_MODS` is set in wp-config.php (`grep DISALLOW_FILE_MODS wp-config.php`). Indicators of a past attack: unexpected themes in Appearance > Themes or under wp-content/themes/ that no administrator installed, Customizer/theme-preview requests in web server logs referencing theme slugs your team never chose, new or unfamiliar administrator accounts, and modified files under wp-content or changes to wp-config.php.

How to Patch

Apply the WordPress 7.1.1 update via Dashboard > Updates or `wp core update`, then verify with `wp core version`. Remove any themes you did not install. As an interim control set `define('DISALLOW_FILE_MODS', true);` in wp-config.php. Rotate database credentials and salts in wp-config.php if you find evidence of an unexpected theme install.

Evidence: BleepingComputer report ↗, Patchstack analysis of the 7.1.1 fix and DISALLOW_FILE_MODS mitigation ↗, The Hacker News coverage ↗

Sources: bleepingcomputer.com ↗, thehackernews.com ↗, patchstack.com ↗

Permalink: /bulletin/2026-09-22/report-wordpress-core-2026-09-22

← Previous Edition Archive Next Edition →