Vulnerability
CVE-2026-107441
An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 could allow an unauthenticated adjacent attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.
CVSS score (v3.1)8.8High
Not on CISA KEV list
Am I affected?
Sign in and add the software you use to your watchlist: we check it against every new vulnerability.
Show me how to fix itTimeline
- Published by NVD
- First covered by RedTeamDaily
- Last updated by NVD
Coverage
Patched Zyxel GS1900 switches remain open to an exploited flaw, Binarly finds
Binarly found that Zyxel GS1900 series switches patched for CVE-2026-7273 remain vulnerable to an in-the-wild exploit. The exploit relies on a separate bug, CVE-2026-107441, which the CVE-2026-7273 patch does not fix. Zyxel's June 2026 advisory covered CVE-2026-7273, a stack-based buffer overflow in a CGI program.
Sources: NVD and CISA known exploited vulnerabilities catalogue.