CVE-2026-107441 in GS1900 Series Switches
Summary
by MITRE • 11/03/2026
An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 could allow an unauthenticated adjacent attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified in Zyxel GS1900-24E network switches, specifically affecting firmware versions up through 2.90(AAHK.2)C0, represents a critical security risk stemming from an out-of-bounds write condition within the device's Common Gateway Interface implementation. This flaw is located in the CGI program that handles HTTP requests for administrative configuration and status monitoring. The nature of this vulnerability allows an attacker who has network access to adjacent segments of the same local area network to interact with the management interface without requiring valid authentication credentials. By constructing a specially crafted HTTP request, an adversary can trigger memory corruption within the embedded operating system environment running on the switch hardware.
From a technical perspective, the root cause lies in insufficient boundary checking when processing input parameters passed through the CGI script. When the firmware processes specific fields in the incoming HTTP payload, it fails to validate the length or content of the data before writing it to a fixed-size buffer in memory. This lack of validation results in an out-of-bounds write, where data is written beyond the allocated limits of the intended memory location. In embedded systems like network switches, such memory corruption can easily overwrite adjacent memory structures, including function return addresses or critical control variables within the process space. This manipulation allows for arbitrary code execution by redirecting the flow of program execution to attacker-controlled shellcode injected via the crafted request.
The operational impact of this vulnerability is severe due to its unauthenticated nature and remote exploitability over a local network segment. An adjacent attacker, such as another user on the same LAN or an insider threat with physical access to switch ports, can gain full control over the operating system running on the device. This level of compromise enables the execution of arbitrary OS commands, which effectively grants the attacker complete administrative privileges equivalent to root access. With this level of control, the adversary can modify network configurations, intercept traffic, install persistent backdoors, or use the compromised switch as a pivot point for further lateral movement into more sensitive parts of the corporate infrastructure. The ability to execute commands without authentication significantly lowers the barrier to entry for exploitation, making it accessible even to attackers with limited technical expertise.
This vulnerability aligns closely with CWE-787, which defines out-of-bounds write vulnerabilities as a category where software writes data beyond the boundary of an allocated buffer. Furthermore, in terms of offensive security frameworks such as MITRE ATT&CK, this exploit scenario maps directly to techniques involving command and script interpretation via web applications or remote services. The attack vector falls under Initial Access using Valid Accounts is not required here, placing it firmly within Unauthenticated Attack vectors often categorized under T1190 Exploit Public-Facing Application if the interface were exposed externally, but in this specific case of adjacent network access, it represents a high-risk internal exploitation path that bypasses standard authentication controls.
Mitigation strategies must prioritize immediate firmware updates to versions released after 2.90(AAHK.2)C0 where Zyxel has addressed the buffer handling logic and implemented stricter input validation within the CGI components. If updating is not immediately feasible, network segmentation should be enforced to restrict access to the management interface of these switches from untrusted or general user subnets. Access Control Lists on upstream routers can also limit which IP addresses are permitted to communicate with the switch's HTTP service ports. Additionally, deploying intrusion detection systems that monitor for anomalous HTTP request patterns containing potential buffer overflow payloads may provide an additional layer of defense against exploitation attempts while patching efforts are underway.