CVE-2026-107441

Description

An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 could allow an unauthenticated adjacent attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.

OhShit! incidents

• Zyxel GS1900 needs a second firmware fix after an in-use pre-auth exploit survives Patch 2 →

References

• www.cve.org/CVERecord ↗
• nvd.nist.gov/vuln/detail/CVE-2026-107441 ↗
• www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026 ↗

Related CVEs

• CVE-2026-13594Zohocorp / Log360 · +1CVSS 9.1
• CVE-2026-120534ACF Extended / Advanced Custom Fields: Extended PROCVSS 9.8
• CVE-2026-120518kalengi / BuddyPress XProfile Custom Image FieldCVSS 9.1
• CVE-2026-86596clavaque / s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access SubscriptionsCVSS 9.8
• CVE-2026-97718Absolute Security / Secure AccessCVSS 9.4
• CVE-2026-58968Google / AndroidCVSS 9.8
• CVE-2026-7273Zyxel / GS1900-48HPv2 firmware · +9KEVCVSS 8.8
• CVE-2024-29972Zyxel / NAS326 firmware · +3CVSS 9.8