CVE-2026-107441: High severity vulnerability
An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 could allow an unauthenticated adjacent attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An unauthenticated attacker on an adjacent network can exploit it. The attacker does not need valid credentials or user interaction, but must be able to reach the affected device over the adjacent network.
Are devices running the affected firmware vulnerable by default?
The available information identifies the vulnerable component as the device CGI program and states that exploitation is performed with a crafted HTTP request. It does not specify any configuration prerequisite, so deployments exposing the device HTTP interface to an adjacent network should be treated as exposed.
What is the potential impact of successful exploitation?
Successful exploitation may allow the attacker to execute OS commands on the affected switch. The supplied severity vector indicates potential high impact to confidentiality, integrity, and availability.