CVE-2026-107441

Summary

An out-of-bounds write in the Zyxel GS1900-24E's CGI program allows unauthenticated adjacent attackers to corrupt memory and potentially execute arbitrary OS commands via crafted HTTP requests.

Exploitability

Exploitation requires network access from the same broadcast domain (adjacent) with no authentication or user interaction; low complexity makes it highly exploitable in shared environments like offices or co-located infrastructure.

Blast radius

Successful exploitation could lead to full system compromise, including data theft, unauthorized configuration changes, and service disruption on the affected switch.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to firmware version 2.90(AAHK.3)C0 or later, as this is the first fixed version following 2.90(AAHK.2)C0.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.