A CVSS attack vector of Adjacent is not a statement about your exposure

On September 21, 2026, CISA added CVE-2026-7273 to the Known Exploited Vulnerabilities catalog with a remediation date of September 24. The same day, GreyNoise published the reason: on or about August 17, one actor exploited and took data from 996 Zyxel GS1900 smart managed switches in 48 countries — Italy 133, United States 129, Taiwan 123. GreyNoise lists what was taken: configurations, networking information, and hashed root-level credentials. Of the 996 victims, 564 had factory-default credentials. Zyxel disclosed the bug and shipped firmware for it on June 16.

The vector said one thing, the victim map said another

Zyxel is the CNA, and Zyxel scored it CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.8. The advisory text agrees: a stack-based buffer overflow in the CGI program that "could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request." AV:A means the attacker is assumed to be on the same layer-2 segment. None of that is wrong as a description of the defect.

It is wrong as a description of where the defect was reachable. GreyNoise attributes the campaign to a single actor working from one IP address, which it is withholding from the post, and the victims sit in 48 countries. Layer-2 adjacency to 996 broadcast domains on four continents is not a thing that exists. Those crafted HTTP requests were routed. The exploit GreyNoise deobfuscated and decompiled takes a target URL as its first positional argument — the usage text shows http://192.168.1.1, but the parameter is a URL, and a URL goes wherever routing takes it.

The structural half is the more useful one. A GS1900 — the affected models run from 8-port to 48-port units — has a single management IP and a web UI, and it acquires a public path in ordinary ways: a port forward someone added to administer it remotely, or a segment carrying public addresses because the switch is what the ISP handoff plugs into. The box gets configured once, by whoever ran the cable, and nobody signs into it again. That is also why 564 of the 996 still had the password that shipped in the carton. The two numbers are one fact seen twice, and for most of these victims the CVE was the second-easiest way in.

Rank against your own exposure list, not against the vector string

Keep a list of management interfaces that answer on public addresses, build it from outside your own network, and rank advisories against that list instead of against the attack-vector field. An AV:A bug on a device that appears on the list is an unauthenticated internet-facing RCE no matter what the CNA scored. The advisory will never tell you which devices those are, because the vendor is describing an intended deployment rather than measuring yours.

CISA's required action on this entry says as much, in a sentence most readers skip: stakeholders "are responsible for evaluating each asset's internet exposure." Exposure is an input the directive asks you to supply, and the three-day deadlines BOD 26-04 produces are computed from facts the catalog does not hold.

The cost is mostly not the scanning. Enumerating HTTP and HTTPS across your public ranges is an afternoon. Turning those addresses into owners is the part that stalls — the reconciliation work that surfaces devices nobody claims needs someone empowered to ask who installed a box and why it has a public address. Budget for that conversation, not the tooling.

If you cannot authorize an external scan this month, open the edge router's NAT and port-forwarding table and read it line by line. Every exposure anyone created on purpose is in there, with the internal address it points at. It misses the accidental ones, which is why it is the fallback rather than the method. The same failure class runs through OT, where the common version is a PLC reachable through a cellular modem.

What to check this week

1. From an address outside your network, request http:// and https:// on every public IP you own, and write down every login page that answers. Do this before looking up a single CVE.
2. Check each GS1900 against the vendor's ten affected models and their fixed versions. Zyxel patched only models "still within their vulnerability support period"; anything you own that is absent from this table needs an answer from Zyxel, not an assumption either way.

3. Rotate the admin credential on every GS1900, patched or not. Patching does not change a password, and here the password is the finding.
4. Treat any GS1900 whose web UI answered on a public address before August 17 as having had its running configuration, interface and routing tables, and hashed root credential read, whether or not it matches an indicator. GreyNoise describes the collector's last act as staging that data for retrieval: cp /tmp/info /home/web/tmp/info.txt.
5. Take the management interface off the public path. That is the fix the advisory did not mention, because AV:A assumed you had already done it.

North InfoSec runs AI-assisted penetration testing and security assessments, including the outside-in enumeration of management interfaces described above. northinfosec.com