CVE-2026-107441

Quick assessment

Affected

Zyxel GS1900-24E firmware

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Zyxel GS1900-24E 设备固件（版本 2.90(AAHK.2)C0 及更早版本）的 CGI 程序中存在一个越界写入漏洞。该漏洞允许未经身份验证的邻近攻击者通过构造恶意的 HTTP 请求利用此缺陷，进而可能执行操作系统命令。

CVSS 8.8 · High Updated Nov 03, 2026

Possible ATT&CK Techniques 2 AI

T1068 · Exploitation for Privilege Escalation T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

N/A

Source: CVE Program / CVE List V5

Vulnerability Description

An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 could allow an unauthenticated adjacent attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

跨界内存写

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE
Zyxel	GS1900-24E firmware	<= 2.90(AAHK.2)C0	-
Zyxel	GS1900-8 firmware	<= 2.90(AAHH.2)C0	-
Zyxel	GS1900-8HP firmware	<= 2.90(AAHI.2)C0	-
Zyxel	GS1900-10HP firmware	<= 2.90(AAZI.2)C0	-
Zyxel	GS1900-16 firmware	<= 2.90(AAHJ.2)C0	-
Zyxel	GS1900-24 firmware	<= 2.90(AAHL.2)C0	-
Zyxel	GS1900-24EP firmware	<= 2.90(ABTO.2)C0	-
Zyxel	GS1900-HPv2 firmware	<= 2.90(ABTP.2)C0	-
Zyxel	GS1900-48 firmware	<= 2.90(AAHN.2)C0	-
Zyxel	GS1900-48HPv2 firmware	<= 2.90(ABTQ.2)C0	-

II. Public POCs for CVE-2026-107441

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-107441

请登录查看更多情报信息。

Other References for CVE-2026-107441 (1)

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026 vendor-advisory

https://www.cve.org/CVERecord?id=CVE-2026-107441

IV. Related Vulnerabilities

Same vendor: Zyxel

Same weakness: CWE-787