TI-2026-84131 Aliases CVE-2026-107441 GHSA-c73h-2jmc-4mfp

Out-of-bounds write in Zyxel GS1900 series firmware CGI program

MEDIUM 40CWE-787Published 2026-11-03 · Updated 2026-11-05

Key facts

Attack vector: Adjacent network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

Zyxel GS1900-24E firmware through 2.90(AAHK.2)C0 and other GS1900 switch firmware models are affected. An out-of-bounds write in the CGI program, classified as CWE-787, lets an unauthenticated adjacent attacker send a crafted HTTP request that can potentially execute OS commands.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 could allow an unauthenticated adjacent attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00293 22nd percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Zyxel	GS1900-24E firmware	up to 2.90(AAHK.2)C0	—	No fix listed	CNA
Zyxel	GS1900-8 firmware	up to 2.90(AAHH.2)C0	—	No fix listed	CNA
Zyxel	GS1900-8HP firmware	up to 2.90(AAHI.2)C0	—	No fix listed	CNA
Zyxel	GS1900-10HP firmware	up to 2.90(AAZI.2)C0	—	No fix listed	CNA
Zyxel	GS1900-16 firmware	up to 2.90(AAHJ.2)C0	—	No fix listed	CNA
Zyxel	GS1900-24 firmware	up to 2.90(AAHL.2)C0	—	No fix listed	CNA
Zyxel	GS1900-24EP firmware	up to 2.90(ABTO.2)C0	—	No fix listed	CNA
Zyxel	GS1900-HPv2 firmware	up to 2.90(ABTP.2)C0	—	No fix listed	CNA
Zyxel	GS1900-48 firmware	up to 2.90(AAHN.2)C0	—	No fix listed	CNA
Zyxel	GS1900-48HPv2 firmware	up to 2.90(ABTQ.2)C0	—	No fix listed	CNA

GS1900-24E firmware VendorZyxel Affected up to 2.90(AAHK.2)C0 Fixed in — No fix listed CNA
GS1900-8 firmware VendorZyxel Affected up to 2.90(AAHH.2)C0 Fixed in — No fix listed CNA
GS1900-8HP firmware VendorZyxel Affected up to 2.90(AAHI.2)C0 Fixed in — No fix listed CNA
GS1900-10HP firmware VendorZyxel Affected up to 2.90(AAZI.2)C0 Fixed in — No fix listed CNA
GS1900-16 firmware VendorZyxel Affected up to 2.90(AAHJ.2)C0 Fixed in — No fix listed CNA
GS1900-24 firmware VendorZyxel Affected up to 2.90(AAHL.2)C0 Fixed in — No fix listed CNA
GS1900-24EP firmware VendorZyxel Affected up to 2.90(ABTO.2)C0 Fixed in — No fix listed CNA
GS1900-HPv2 firmware VendorZyxel Affected up to 2.90(ABTP.2)C0 Fixed in — No fix listed CNA
GS1900-48 firmware VendorZyxel Affected up to 2.90(AAHN.2)C0 Fixed in — No fix listed CNA
GS1900-48HPv2 firmware VendorZyxel Affected up to 2.90(ABTQ.2)C0 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Zyxel GS1900-24E firmware. The sources list no fixed version for Zyxel GS1900-8 firmware, GS1900-8HP firmware, GS1900-10HP firmware, GS1900-16 firmware and other listed models.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Timeline

2026-11-03 Threatist record created from CVE-2026-107441
2026-11-03 Alias added: GHSA-c73h-2jmc-4mfp
2026-11-04 Priority changed: MEDIUM → LOW
2026-11-04 CISA SSVC decision points changed
2026-11-04 Priority changed: LOW → MEDIUM
2026-11-04 CISA SSVC decision points changed
2026-11-05 CISA SSVC decision points changed

References

Advisory 1

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026

TI-2023-16198 Buffer overflow in Zyxel ATP series firmware KEVCVSS 3.1CRITICAL 9.8
TI-2023-16197 Buffer overflow in Zyxel ATP series firmware KEVCVSS 3.1CRITICAL 9.8
TI-2023-13281 OS command injection in Zyxel ZyWALL/USG series firmware KEVCVSS 3.1CRITICAL 9.8
TI-2023-12582 OS command injection in Zyxel NAS326 firmware KEVCVSS 3.1CRITICAL 9.8
TI-2022-12682 OS command injection in Zyxel USG FLEX 100 firmware KEVCVSS 3.1CRITICAL 9.8
TI-2020-17772 Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with… KEVCVSS 3.1CRITICAL 9.8

See all 340 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences