CVE-2026-107441
Received Received - Intake

Out-of-Bounds Write in Zyxel GS1900-24E Firmware

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: Zyxel Corporation

Description
An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 could allow an unauthenticated adjacent attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-107441

Affected Vendors & Products

Showing 10 associated CPEs
Vendor Product Version / Range
Zyxel GS1900-24E firmware <= 2.90(AAHK.2)C0
Zyxel GS1900-8 firmware <= 2.90(AAHH.2)C0
Zyxel GS1900-8HP firmware <= 2.90(AAHI.2)C0
Zyxel GS1900-10HP firmware <= 2.90(AAZI.2)C0
Zyxel GS1900-16 firmware <= 2.90(AAHJ.2)C0
Zyxel GS1900-24 firmware <= 2.90(AAHL.2)C0
Zyxel GS1900-24EP firmware <= 2.90(ABTO.2)C0
Zyxel GS1900-HPv2 firmware <= 2.90(ABTP.2)C0
Zyxel GS1900-48 firmware <= 2.90(AAHN.2)C0
Zyxel GS1900-48HPv2 firmware <= 2.90(ABTQ.2)C0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an out-of-bounds write vulnerability in the CGI program of Zyxel GS1900 series switch firmware. An unauthenticated attacker on the same local network can send a specially crafted HTTP request to exploit this flaw and potentially execute operating system commands on the affected device.

Detection Guidance

Detect this vulnerability by checking the firmware version of your Zyxel GS1900 series switch. Use the switch's web interface or CLI to verify if the firmware is version 2.90(AAHK.2)C0 or earlier. Affected models include GS1900-8, GS1900-8HP, GS1900-10HP, GS1900-16, GS1900-24, GS1900-24E, GS1900-24EP, GS1900-24HPv2, GS1900-48, and GS1900-48HPv2.

Impact Analysis

An attacker could gain control of your network switch, allowing them to intercept traffic, modify configurations, or launch further attacks within your local network. This could lead to data breaches or network disruption.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Immediately update the firmware of your Zyxel GS1900 series switch to the latest patched version. For example, update GS1900-24E to 2.90(AAHK.3)C0. Isolate the switch from untrusted networks if possible and monitor for unusual activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-107441. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...