Skip to content
Out-of-Bounds Write Vulnerability in Zyxel GS1900 Series Switches

Out-of-Bounds Write Vulnerability in Zyxel GS1900 Series Switches

First seen 3 Nov 2026, 09:42 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 3, 2026 at 17:17 UTC
  • •CVE-2026-107441 affects Zyxel GS1900 series switches with a CVSS score of 8.8.
  • •Unauthenticated adjacent attackers can exploit the vulnerability via crafted HTTP requests.
  • •Patches have been released, and users are urged to update their firmware immediately.

An out-of-bounds write vulnerability (CVE-2026-107441) has been identified in the CGI program of Zyxel GS1900 series switches, allowing unauthenticated adjacent attackers to execute arbitrary OS commands via crafted HTTP requests. The vulnerability affects firmware versions through 2.90(AAHK.2)C0. Zyxel has released patches for the affected models, urging users to update their firmware for optimal protection. Currently, there is no evidence of public proof-of-concept exploitation or confirmed exploitation in the wild. The CVSS score assigned to this vulnerability is 8.8, indicating a high severity level. Security professionals are advised to restrict network access to management interfaces and monitor for suspicious HTTP requests targeting the CGI program.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-11-03
CVE-2026-107441 published
Zyxel disclosed an out-of-bounds write vulnerability affecting GS1900 series switches with a CVSS score of 8.8.
Feedly
2026-11-03
Patches released
Zyxel released patches for affected GS1900 series switches and advised users to install them for protection.
www.zyxel.com

More articles in this cluster (5)

Following this threat?

Track CVE-2026-107441 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (7)

1 / 4

Common questions

Which firmware versions are affected?
The vulnerability affects Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0.
Is there confirmed exploitation of this vulnerability?
No, there is currently no evidence of confirmed exploitation or public proof-of-concept.
What should users do to protect their devices?
Users should immediately apply the patches released by Zyxel for the affected GS1900 series switches.