{"id":"CVE-2026-107441","kind":"vulnerability","aliases":["CVE-2026-107441"],"related":[],"title":"Zyxel GS1900-24E switch: crafted HTTP request can run OS commands","description":"An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 could allow an unauthenticated adjacent attacker  to exploit the flaw and potentially execute OS commands via a crafted HTTP request.","summary":"The CGI web program in Zyxel GS1900-24E switch firmware through 2.90(AAHK.2)C0 has an out-of-bounds write flaw. An unauthenticated attacker on an adjacent network can send a crafted HTTP request that may execute operating system commands on the switch.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"GS1900-24E firmware","fixed":["2.90(AAHK.3)C0"],"affected":"<= 2.90(AAHK.2)C0","ecosystem":"vendor"}],"ecosystems":[],"tags":["adjacent-network","firmware","gs1900-24e","infrastructure","network-switch","zyxel"],"not_affected_if":["other-firmware-versions","web-management-not-reachable"],"how_to_check":"- Read the firmware version in the switch web UI or console; GS1900-24E at 2.90(AAHK.2)C0 or earlier is affected, 2.90(AAHK.3)C0 is the fixed release.\n- Check that the switch's web management interface is reachable only from a trusted management VLAN; the attacker needs to be on the same adjacent network.\n- Also check if you run other GS1900 models (-8, -8HP, -10HP, -16, -24, -24EP, -24HPv2, -48, -48HPv2): Zyxel's Patch 3 notes list the same CVE fix for all of them, but I could not read the advisory's affected-model table.","fix":"Upgrade GS1900-24E firmware to V2.90(AAHK.3)C0 (Zyxel GS1900 V2.90 Patch 3, Oct 2026). Patch 3 release notes: 'Fixed pre-authentication out-of-bounds write vulnerability (CVE-2026-107441)'.","status":"open","published_at":"2026-11-03T02:16:52+00:00","first_seen_at":"2026-11-03T02:47:45+00:00","triaged_at":"2026-11-03T02:48:57+00:00","updated_at":"2026-11-03T02:51:41+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-03T02:48:57Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Zyxel GS1900-24E switch: crafted HTTP request can run OS commands","impact":"high","summary":"The CGI web program in Zyxel GS1900-24E switch firmware through 2.90(AAHK.2)C0 has an out-of-bounds write flaw. An unauthenticated attacker on an adjacent network can send a crafted HTTP request that may execute operating system commands on the switch.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["zyxel","gs1900-24e","network-switch","firmware"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs OS commands on the switch without credentials","analyst_note":"Check Zyxel's advisory for the fixed firmware version and whether the web CGI must be enabled; sources only give the NVD description.","how_to_check":"- Check the firmware version on the switch's web interface or console against the affected range (through 2.90(AAHK.2)C0).\n- Confirm whether the switch's web management interface is reachable from networks outside the management VLAN.","plain_action":"","needs_analyst":true,"not_affected_if":["other-firmware-versions","web-management-not-reachable"],"who_is_affected":"Organizations running Zyxel GS1900-24E switches with firmware through 2.90(AAHK.2)C0 whose web management interface is reachable by an attacker on an adjacent network. The sources do not describe further configuration conditions or whether the web interface must be enabled.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000704,"input_tokens":4142,"output_tokens":579,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check Zyxel's advisory for the fixed firmware version and whether the web CGI must be enabled; sources only give the NVD description.","search":"'-107441':15A,18A '-2026':14A,17A '2.90':47B,99C '24e':4A,21A,29B,43B,95C 'aahk.2':48B,100C 'adjac':24B,63B,106C 'adjacent-network':23B 'allow':103C 'attack':60B,107C 'bound':55B,84C 'c0':49B,101C 'cgi':36B,89C 'command':12A,76B,116C 'could':102C 'craft':6A,68B,119C 'cve':13A,16A 'execut':73B,114C 'exploit':109C 'firmwar':26B,45B,96C 'firmware':22A 'flaw':57B,111C 'gs1900':3A,20A,28B,42B,94C 'gs1900-24e':2A,19A,27B,41B,93C 'http':7A,69B,120C 'infrastructur':30B 'may':72B 'network':25B,32B,64B 'network-switch':31B 'oper':74B 'os':11A,115C 'out-of-bound':52B,81C 'potenti':113C 'program':38B,90C 'request':8A,70B,121C 'run':10A 'send':66B 'switch':5A,33B,44B,79B 'system':75B 'unauthent':59B,105C 'version':97C 'via':117C 'vulner':86C 'web':37B 'write':56B,85C 'zyxel':1A,34B,40B,92C","nicknames":[],"mitigations":[],"who_affected":"Anyone running a Zyxel GS1900-24E switch on firmware 2.90(AAHK.2)C0 or earlier. An unauthenticated attacker on the same adjacent/LAN network can send a crafted HTTP request to the web CGI and may run OS commands on the switch. Switches whose web management is only reachable from a locked-down management network are lower risk; setups without these switches can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-03T02:51:41Z","by":"analyst","doc":"https://community.zyxel.com/en/discussion/34420/switch-gs1900-series-v2-90-patch-3-firmware-release","run_id":1448}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["firmware","gs190024efirmware"],"ptokens":["24e","firmware","gs1900"],"labels":["adjacentnetwork","firmware","gs190024e","high","infrastructure","networkswitch","zyxel"],"first_public_at":"2026-11-03T02:16:52+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@zyxel.com.tw","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107441","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107441","severity":null,"published_at":"2026-11-03T02:16:52+00:00","modified_at":"2026-11-03T02:16:52+00:00","first_seen_at":"2026-11-03T02:47:45+00:00","fetched_at":"2026-11-03T02:47:45+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-107441:1448","url":null,"severity":null,"published_at":"2026-11-03T02:51:41+00:00","modified_at":"2026-11-03T02:51:41+00:00","first_seen_at":"2026-11-03T02:51:41+00:00","fetched_at":"2026-11-03T02:51:41+00:00","note":"Zyxel Patch 3 release note (vendor community) gives fix 2.90(AAHK.3)C0; verified only fix. Zyxel advisory page itself not readable (URL returned index only), so affected list for other GS1900 models and whether web CGI can be disabled are unconfirmed. Sibling CVE-2026-7273 (same line) is in CISA KEV; this one has no known exploitation. Severity left high (CVSS 8.8 AV:A)."}],"documents":[{"id":55140,"url":"https://community.zyxel.com/en/discussion/34420/switch-gs1900-series-v2-90-patch-3-firmware-release","title":"Zyxel GS1900 Series V2.90 Patch 3 Firmware Release","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":55141,"url":"https://www.zyxel.com/global/en/support/security-advisories","title":"Zyxel Security Advisories index (lists CVE-2026-107441 advisory, Nov 3 2026)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}