CVE-2026-107441

CVE Enrichment

CVSS: 8.8 HIGH
EPSS: 0.29%
EPSS Percentile: 22.03%
CISA KEV: Not listed

Description

An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 could allow an unauthenticated adjacent attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 03-Nov-2026 09:16
Last Modified: 04-Nov-2026 21:17
EPSS Date: 2026-11-04
CWE: CWE-787

CVSS Vector


            CVSS:3.1                            AV:A /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

CNA Products / Version Status

Zyxel · GS1900-10HP firmware Source: CNA · [email protected]
Default status: unaffected

<= 2.90(AAZI.2)C0 — affected
Zyxel · GS1900-16 firmware Source: CNA · [email protected]
Default status: unaffected

<= 2.90(AAHJ.2)C0 — affected
Zyxel · GS1900-24 firmware Source: CNA · [email protected]
Default status: unaffected

<= 2.90(AAHL.2)C0 — affected
Zyxel · GS1900-24E firmware Source: CNA · [email protected]
Default status: unaffected

<= 2.90(AAHK.2)C0 — affected
Zyxel · GS1900-24EP firmware Source: CNA · [email protected]
Default status: unaffected

<= 2.90(ABTO.2)C0 — affected
Zyxel · GS1900-48 firmware Source: CNA · [email protected]
Default status: unaffected

<= 2.90(AAHN.2)C0 — affected
Zyxel · GS1900-48HPv2 firmware Source: CNA · [email protected]
Default status: unaffected

<= 2.90(ABTQ.2)C0 — affected
Zyxel · GS1900-8 firmware Source: CNA · [email protected]
Default status: unaffected

<= 2.90(AAHH.2)C0 — affected
Zyxel · GS1900-8HP firmware Source: CNA · [email protected]
Default status: unaffected

<= 2.90(AAHI.2)C0 — affected
Zyxel · GS1900-HPv2 firmware Source: CNA · [email protected]
Default status: unaffected

<= 2.90(ABTP.2)C0 — affected

References

[email protected]

Last enrichment sync: 05-Nov-2026 09:04
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (2)

flaw tracked as CVE-2026-7273. The new 2.90 Patch 3 firmware fixes a flaw now tracked separately as CVE-2026-107441, which the exploit relies on. It was posted on October 23, and the vendor announced it in an advisory Zyxel GS1900 Patch 2 Fails to Stop Unauthenticated Root-Command Exploit
The vulnerability, tracked as CVE-2026-107441, is an out-of-bounds write flaw in the switches' web management interface that allows an unauthenticated attacker with network access to execute operating system commands Zyxel Patches Zero-Day Used to Compromise Nearly 1,000 GS1900 Switches

CVE (1)

Malware (2)

Threat Actors (2)

MITRE ATT&CK (4)

Vendors (2)

Products (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.