CVE-2026-107441
📛 CVE Title
CVE-2026-107441
Description
An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 could allow an unauthenticated adjacent attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- Zyxel
- CVSS severity
- HIGH
- CVSS score
- 8.8 / 10
- CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Effective score
- 8.8 / 10 HIGH source: CNA overview
- CWE(s)
-
CWE-787 - Reserved
- 2026-10-08
- Published
- 2026-11-03 01:41 UTC
- Last updated
- 2026-11-03 01:41 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107441.json
- Linked Threat
- CVE-2026-107441 — CVE-2026-107441
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-115654
EUVD enrichment is queued; refresh the page in a few seconds.
Affected products (10)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| Zyxel | GS1900-24E firmware |
<= 2.90(AAHK.2)C0 (affected)
|
— |
| Zyxel | GS1900-8 firmware |
<= 2.90(AAHH.2)C0 (affected)
|
— |
| Zyxel | GS1900-8HP firmware |
<= 2.90(AAHI.2)C0 (affected)
|
— |
| Zyxel | GS1900-10HP firmware |
<= 2.90(AAZI.2)C0 (affected)
|
— |
| Zyxel | GS1900-16 firmware |
<= 2.90(AAHJ.2)C0 (affected)
|
— |
| Zyxel | GS1900-24 firmware |
<= 2.90(AAHL.2)C0 (affected)
|
— |
| Zyxel | GS1900-24EP firmware |
<= 2.90(ABTO.2)C0 (affected)
|
— |
| Zyxel | GS1900-HPv2 firmware |
<= 2.90(ABTP.2)C0 (affected)
|
— |
| Zyxel | GS1900-48 firmware |
<= 2.90(AAHN.2)C0 (affected)
|
— |
| Zyxel | GS1900-48HPv2 firmware |
<= 2.90(ABTQ.2)C0 (affected)
|
— |
Vendor references (1)
References embedded in the original CVE record by the assigning CNA.
Web references (0)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
No web references attached yet.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2026-107441.json.
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "GS1900-24E firmware",
"vendor": "Zyxel",
"versions": [
{
"status": "affected",
"version": "<= 2.90(AAHK.2)C0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "GS1900-8 firmware",
"vendor": "Zyxel",
"versions": [
{
"status": "affected",
"version": "<= 2.90(AAHH.2)C0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "GS1900-8HP firmware",
"vendor": "Zyxel",
"versions": [
{
"status": "affected",
"version": "<= 2.90(AAHI.2)C0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "GS1900-10HP firmware",
"vendor": "Zyxel",
"versions": [
{
"status": "affected",
"version": "<= 2.90(AAZI.2)C0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "GS1900-16 firmware",
"vendor": "Zyxel",
"versions": [
{
"status": "affected",
"version": "<= 2.90(AAHJ.2)C0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "GS1900-24 firmware",
"vendor": "Zyxel",
"versions": [
{
"status": "affected",
"version": "<= 2.90(AAHL.2)C0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "GS1900-24EP firmware",
"vendor": "Zyxel",
"versions": [
{
"status": "affected",
"version": "<= 2.90(ABTO.2)C0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "GS1900-HPv2 firmware",
"vendor": "Zyxel",
"versions": [
{
"status": "affected",
"version": "<= 2.90(ABTP.2)C0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "GS1900-48 firmware",
"vendor": "Zyxel",
"versions": [
{
"status": "affected",
"version": "<= 2.90(AAHN.2)C0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "GS1900-48HPv2 firmware",
"vendor": "Zyxel",
"versions": [
{
"status": "affected",
"version": "<= 2.90(ABTQ.2)C0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 could allow an unauthenticated adjacent attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request."
}
],
"value": "An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 could allow an unauthenticated adjacent attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T01:41:52.029Z",
"orgId": "96e50032-ad0d-4058-a115-4d2c13821f9f",
"shortName": "Zyxel"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "96e50032-ad0d-4058-a115-4d2c13821f9f",
"assignerShortName": "Zyxel",
"cveId": "CVE-2026-107441",
"datePublished": "2026-11-03T01:41:52.029Z",
"dateReserved": "2026-10-08T02:07:52.349Z",
"dateUpdated": "2026-11-03T01:41:52.029Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}