Zyxel GS1900-24E: Out-of-bounds write vulnerability (CVE-2026-107441)
An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 could allow an unauthenticated adjacent attacker to potentially execute OS commands via a crafted HTTP request.
CVE search metadata
CVE search record: CVE-2026-107441. Severity: high. CVSS: 8.8. KEV: no. Product: GS1900-24E (through firmware 2.90(AAHK.2)C0). Brief: Zyxel GS1900-24E: Out-of-bounds write vulnerability (CVE-2026-107441). Brief link: https://feed.craftedsignal.io/briefs/2026-11-zyxel-gs1900-24e-oob-write/
Triage facts
Revision 2- Applicability
- GS1900-24E (through firmware 2.90(AAHK.2)C0)
- Evidence
- Not observed
- Severity
- High
- Sources
- 2 public sources
- Freshness
- Revision 2Nov 3, 04:05 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Revision history 1 entry · Revision 2
- Revision 2
poc_available
Changed: claim_state, has_poc, lastmod, poc_references, references, updates
Sources: 1
An out-of-bounds write vulnerability exists in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0. This flaw may allow an unauthenticated adjacent attacker to potentially execute OS commands via a crafted HTTP request. The vulnerability is identified as CVE-2026-107441 with a CVSS v3.1 base score of 8.8.