CVE-2026-107441

HIGH 8.8

CVSS 3.1Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HPublished: 2026-11-03 01:41 UTCUpdated: 2026-11-03 01:41 UTCAssigner: Zyxel

Description

An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 could allow an unauthenticated adjacent attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.

CWE

CWE-787

Affected

Zyxel GS1900-24E firmware; Zyxel GS1900-8 firmware; Zyxel GS1900-8HP firmware; Zyxel GS1900-10HP firmware; Zyxel GS1900-16 firmware; Zyxel GS1900-24 firmware; Zyxel GS1900-24EP firmware; Zyxel GS1900-HPv2 firmware; Zyxel GS1900-48 firmware; Zyxel GS1900-48HPv2 firmware

References

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026vendor-advisory

View on CVE.org