The vulnerability is a stack‑based buffer overflow in the CGI program of Zyxel GS1900 switches, allowing a LAN‑based unauthenticated attacker to send a crafted HTTP request that can result in execution of operating‑system commands. Attackers could potentially compromise the switch’s operating system, leading to full control over the device.

Affected devices include Zyxel GS1900‑8, GS1900‑8HP, GS1900‑10HP, GS1900‑16, GS1900‑24, GS1900‑24E, GS1900‑24EP, GS1900‑24HPv2, GS1900‑48, and GS1900‑48HPv2 firmware versions up through and including 2.90(ABTQ.1)C0.

The CVSS score of 8.8 indicates high severity, while the EPSS score of less than 1% suggests a low probability of exploitation at present. It is not listed in CISA’s KEV catalog. Exploitation requires an unauthenticated connection from a device on the same local network that can reach the switch’s HTTP management interface. Successful exploitation could provide the attacker with the ability to run arbitrary OS commands on the device.