{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/aps/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":["Red Heron"],"_cs_cpes":["cpe:2.3:a:zyxel:gs1900_24e:*:*:*:*:*:*:*:*","cpe:2.3:a:zyxel:nwa110ax:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-107441"},{"cvss":8.8,"id":"CVE-2026-76955"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":["https://sploitus.com/exploit?id=CVE-2026-107441\u0026utm_source=rss\u0026utm_medium=rss"],"_cs_products":["GS1900-24E (through firmware 2.90(AAHK.2)C0)","NWA110AX (\u003c= 7.12)","GS1900 series switches","APs","FWA7","Security Routers","GS1900-8 (2.90(AAHH.2)C0 and earlier)","GS1900-8HP (2.90(AAHI.2)C0 and earlier)","GS1900-10HP (2.90(AAZI.2)C0 and earlier)","GS1900-16 (2.90(AAHJ.2)C0 and earlier)","GS1900-24 (2.90(AAHL.2)C0 and earlier)","GS1900-24E (2.90(AAHK.2)C0 and earlier)","GS1900-24EP (2.90(ABTO.2)C0 and earlier)","GS1900-24HPv2 (2.90(ABTP.2)C0 and earlier)","GS1900-48 (2.90(AAHN.2)C0 and earlier)","GS1900-48HPv2 (2.90(ABTQ.2)C0 and earlier)"],"_cs_severities":["critical"],"_cs_tags":["vulnerability","network-security","rce","root-access"],"_cs_type":"threat","_cs_vendors":["Zyxel"],"content_html":"\u003cp\u003eResearch by Binarly has identified that Zyxel GS1900 network switches remain vulnerable to unauthenticated remote command execution despite the application of previous security patches (Patch 2). The vulnerability, tracked as CVE-2026-107441, stems from an out-of-bounds write in the switch's web management interface.\u003c/p\u003e\n\u003cp\u003eThe flaw exists because input validation logic in the Patch 2 firmware occurs only after the memory corruption has already triggered, allowing an attacker to overwrite internal control variables and redirect execution flow to attacker-supplied commands. Zyxel has released Patch 3 firmware to remediate this issue.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies internet-exposed GS1900 switch management interface.\u003c/li\u003e\n\u003cli\u003eAttacker sends a crafted HTTP request with an oversized 140th parameter to the web management service.\u003c/li\u003e\n\u003cli\u003eThe service performs an out-of-bounds write, overwriting the parameter counter and subsequent memory.\u003c/li\u003e\n\u003cli\u003eThe attacker achieves arbitrary code execution with root privileges.\u003c/li\u003e\n\u003cli\u003eThe attacker downloads and executes a data-collection script.\u003c/li\u003e\n\u003cli\u003eThe script harvests configuration data and hashed root credentials from the device.\u003c/li\u003e\n\u003cli\u003eData is staged for exfiltration via the web interface.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to gain root-level access to the switch. Observed impact includes the exfiltration of device configurations and hashed root credentials. Attackers have been observed targeting these devices to perform mass data collection, with a high proportion of affected devices identified as still running factory-default credentials.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eImmediately apply the 2.90 Patch 3 firmware update to all Zyxel GS1900 models listed in the advisory.\u003c/li\u003e\n\u003cli\u003eInventory all internet-exposed network management interfaces and restrict access to these services to trusted management subnets via firewall rules.\u003c/li\u003e\n\u003cli\u003eAudit all GS1900 switches for evidence of unauthorized persistent scripts or modified configuration files.\u003c/li\u003e\n\u003cli\u003eRotate all credentials on any GS1900 switches that were reachable via the internet prior to patching, particularly those where default credentials remained in use.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-11-05T08:52:11Z","date_published":"2026-11-03T03:50:17Z","id":"https://feed.craftedsignal.io/briefs/2026-11-zyxel-gs1900-24e-oob-write/","summary":"Zyxel GS1900 series switches are vulnerable to unauthenticated remote code execution due to an out-of-bounds write in the web management interface that persists in previously patched firmware, facilitating credential theft and configuration harvesting by the Red Heron threat actor.","title":"Zyxel GS1900 Series: Unauthenticated Remote Command Execution (CVE-2026-107441)","url":"https://feed.craftedsignal.io/briefs/2026-11-zyxel-gs1900-24e-oob-write/"}],"language":"en","title":"CraftedSignal Threat Feed - APs","version":"https://jsonfeed.org/version/1.1"}