Live › vulnerability › CVE-2026-107441
The CGI web program in Zyxel GS1900-24E switch firmware through 2.90(AAHK.2)C0 has an out-of-bounds write flaw. An unauthenticated attacker on an adjacent network can send a crafted HTTP request that may execute operating system commands on the switch.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 02:47 UTC. All times on this page are UTC.
Anyone running a Zyxel GS1900-24E switch on firmware 2.90(AAHK.2)C0 or earlier. An unauthenticated attacker on the same adjacent/LAN network can send a crafted HTTP request to the web CGI and may run OS commands on the switch. Switches whose web management is only reachable from a locked-down management network are lower risk; setups without these switches can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| GS1900-24E firmware | vendor | <= 2.90(AAHK.2)C0 | 2.90(AAHK.3)C0 |
Fixed pre-authentication out-of-bounds write vulnerability (CVE-2026-107441)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 could allow an unauthenticated adjacent attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.
This page as .md · .json · in your agent: get_signal("CVE-2026-107441")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.