---
id: "CVE-2026-107441"
kind: "vulnerability"
aliases: ["CVE-2026-107441"]
title: "Zyxel GS1900-24E switch: crafted HTTP request can run OS commands"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "GS1900-24E firmware", "fixed": ["2.90(AAHK.3)C0"], "affected": "<= 2.90(AAHK.2)C0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["adjacent-network", "firmware", "gs1900-24e", "infrastructure", "network-switch", "zyxel"]
not_affected_if: ["other-firmware-versions", "web-management-not-reachable"]
published_at: "2026-11-03T02:16:52+00:00"
first_seen_at: "2026-11-03T02:47:45+00:00"
updated_at: "2026-11-03T02:51:41+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107441", "first_seen_at": "2026-11-03T02:47:45+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T02:51:41+00:00"}]
---

# Zyxel GS1900-24E switch: crafted HTTP request can run OS commands

The CGI web program in Zyxel GS1900-24E switch firmware through 2.90(AAHK.2)C0 has an out-of-bounds write flaw. An unauthenticated attacker on an adjacent network can send a crafted HTTP request that may execute operating system commands on the switch.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:GS1900-24E firmware affected <= 2.90(AAHK.2)C0 fixed 2.90(AAHK.3)C0

## How to check

- Read the firmware version in the switch web UI or console; GS1900-24E at 2.90(AAHK.2)C0 or earlier is affected, 2.90(AAHK.3)C0 is the fixed release.
- Check that the switch's web management interface is reachable only from a trusted management VLAN; the attacker needs to be on the same adjacent network.
- Also check if you run other GS1900 models (-8, -8HP, -10HP, -16, -24, -24EP, -24HPv2, -48, -48HPv2): Zyxel's Patch 3 notes list the same CVE fix for all of them, but I could not read the advisory's affected-model table.

## Fix

Upgrade GS1900-24E firmware to V2.90(AAHK.3)C0 (Zyxel GS1900 V2.90 Patch 3, Oct 2026). Patch 3 release notes: 'Fixed pre-authentication out-of-bounds write vulnerability (CVE-2026-107441)'.

## Timeline

- 2026-11-03T02:47:45+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107441
- 2026-11-03T02:51:41+00:00 analyst — Zyxel Patch 3 release note (vendor community) gives fix 2.90(AAHK.3)C0; verified only fix. Zyxel advisory page itself not readable (URL returned index only), so affected list for other GS1900 models and whether web CGI can be disabled are unconfirmed. Sibling CVE-2026-7273 (same line) is in CISA KEV; this one has no known exploitation. Severity left high (CVSS 8.8 AV:A).

## Documents

- [fix] Zyxel GS1900 Series V2.90 Patch 3 Firmware Release https://community.zyxel.com/en/discussion/34420/switch-gs1900-series-v2-90-patch-3-firmware-release
- [mentions] Zyxel Security Advisories index (lists CVE-2026-107441 advisory, Nov 3 2026) https://www.zyxel.com/global/en/support/security-advisories

## From the sources

An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 could allow an unauthenticated adjacent attacker  to exploit the flaw and potentially execute OS commands via a crafted HTTP request.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_