Description
An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 could allow an unauthenticated adjacent attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.
Published: 2026-11-03
Score: 8.8 High
EPSS: n/a
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A buffer overflow in the CGI service of Zyxel GS1900 series switches allows an unauthenticated attacker connected to the same local network to send a crafted HTTP request. The write overflow can lead to arbitrary OS command execution, giving the attacker full control over the switch’s operating system. The flaw is a classic out-of-bounds write and is classified under CWE-787.

Affected Systems

Zyxel GS1900 switches—including models GS1900-8, GS1900-8HP, GS1900-10HP, GS1900-16, GS1900-24, GS1900-24E, GS1900-24EP, GS1900-48, GS1900-48HPv2, and GS1900-HPv2—are affected when running firmware versions up to 2.90(AAHK.2)C0. All firmware revisions through and including that release contain the vulnerable CGI code.

Risk and Exploitability

The CVSS score of 8.8 indicates high severity, and while an EPSS score is not available, the vulnerability can be exploited by any attacker who can reach the switch’s HTTP interface from a local network. Because the attack does not require authentication, the risk to switches that are exposed to adjacent or remote networks is significant. The flaw is not yet listed in the CISA KEV catalog, but the potential for destructive impact warrants urgent action.

Generated by OpenCVE AI on November 3, 2026 at 03:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the switch firmware to a version newer than 2.90(AAHK.2)C0, which includes the fixed CGI code.
  • Restrict access to the switch’s HTTP interface by applying firewall or ACL rules so that only trusted IP addresses can communicate with the CGI service.
  • Apply network segmentation so that the switch is not directly reachable from untrusted or guest networks, reducing the chance that an adjacent attacker can send malicious HTTP requests.

Generated by OpenCVE AI on November 3, 2026 at 03:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 03 Nov 2026 03:45:00 +0000

Type Values Removed Values Added
Title Out-of-Bounds Write in Zyxel GS1900 Series CGI Enables Remote Command Execution

Tue, 03 Nov 2026 02:00:00 +0000

Type Values Removed Values Added
Description An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 could allow an unauthenticated adjacent attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.
Weaknesses CWE-787
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Zyxel

Published:

Updated: 2026-11-03T01:41:52.029Z

Reserved: 2026-10-08T02:07:52.349Z

Link: CVE-2026-107441

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-03T02:16:52.617

Modified: 2026-11-03T02:16:52.617

Link: CVE-2026-107441

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-03T03:30:14Z

Weaknesses