VDB

CVE-2026-107441

CVE-2026-107441 PUBLISHED CVSS 8.8 HIGH

Reported by zyxel · Published November 3, 2026

An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 could allow an unauthenticated adjacent attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.

Risk scores

CVSS 3.1
8.8
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

VendorProductVersions
ZyxelGS1900-24E firmware<= 2.90(AAHK.2)C0
ZyxelGS1900-8 firmware<= 2.90(AAHH.2)C0
ZyxelGS1900-8HP firmware<= 2.90(AAHI.2)C0
ZyxelGS1900-10HP firmware<= 2.90(AAZI.2)C0
ZyxelGS1900-16 firmware<= 2.90(AAHJ.2)C0
ZyxelGS1900-24 firmware<= 2.90(AAHL.2)C0
ZyxelGS1900-24EP firmware<= 2.90(ABTO.2)C0
ZyxelGS1900-HPv2 firmware<= 2.90(ABTP.2)C0
ZyxelGS1900-48 firmware<= 2.90(AAHN.2)C0
ZyxelGS1900-48HPv2 firmware<= 2.90(ABTQ.2)C0
ZyxelGS1900-48HPv2 firmware0
ZyxelGS1900-8HP firmware0
ZyxelGS1900-HPv2 firmware0
ZyxelGS1900-24EP firmware0
ZyxelGS1900-8 firmware0
ZyxelGS1900-16 firmware0
ZyxelGS1900-10HP firmware0
ZyxelGS1900-24 firmware0
ZyxelGS1900-24E firmware0
ZyxelGS1900-48 firmware0

Timeline

  • Nov 3, 2026 CVE Published
  • Nov 3, 2026 VulnCheck KEV Exploitation
  • Nov 3, 2026 EPSS Score

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2026-107441
vulnetix vdb fixes CVE-2026-107441

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-107441/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

  • vendor-advisory
Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›