Back Sploitus

CVE-2026

Sploitus • November 3, 2026

An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 could allow an unauthenticated adjacent attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Out-of-Bounds Write Vulnerability in Zyxel GS1900 Series Switches An out-of-bounds write vulnerability (CVE-2026-107441) has been identified in the CGI program of Zyxel GS1900 series switches, allowing unauthenticated adjacent attackers to execute arbitrary OS commands via crafted HTTP requests. The vulnerability affects firmware versions through 2.90(AAHK.2)C0. Zyxel has released patches for the affected models, urging users to update their firmware for optimal protection. Currently, there is no evidence of public proof-of-concept exploitation or confirmed exploitation in the wild. The CVSS score assigned to this vulnerability is 8.8, indicating a high severity level. Security professionals are advised to restrict network access to management interfaces and monitor for suspicious HTTP requests targeting the CGI program. 2 sources 71

Extracted Entities

CVE-2026

The full story

Extracted Entities

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (1)

Vulnerabilities (1)