Multiple security vulnerabilities have been identified in Zyxel GS1900 network switches, affecting the web interface and request-handling logic. The flaws can allow an unauthenticated attacker on an adjacent network to execute operating-system commands, creating a high risk of remote compromise. Affected firmware includes versions through 2.90(xxxx.2)C0 on affected GS1900 models. Both issues have been exploited in the wild, and the combination of memory corruption and missing input validation makes exposed devices especially vulnerable.
CVE-2026-107441 (CVSS 8.8 — High): This out-of-bounds write, exploited in the wild, occurs in the switch web interface's HTTP POST request handling, where request parameters are copied into a fixed-size buffer without adequate size or count validation. An unauthenticated attacker on an adjacent network can send a crafted request to corrupt memory, redirect execution, and run operating-system commands.[/subscribe_to_unlock_form]
Multiple security vulnerabilities have been identified in Zyxel GS1900 network switches, affecting the web interface and request-handling logic. The flaws can allow an unauthenticated attacker on an adjacent network to execute operating-system commands, creating a high risk of remote compromise. Affected firmware includes versions through 2.90(xxxx.2)C0 on affected GS1900 models. Both issues have been exploited in the wild, and the combination of memory corruption and missing input validation makes exposed devices especially vulnerable.
CVE-2026-107441 (CVSS 8.8 — High): This out-of-bounds write, exploited in the wild, occurs in the switch web interface's HTTP POST request handling, where request parameters are copied into a fixed-size buffer without adequate size or count validation. An unauthenticated attacker on an adjacent network can send a crafted request to corrupt memory, redirect execution, and run operating-system commands.[emaillocker id="1283"]
CVE-2026-7273 (CVSS 8.8 — High): This stack-based buffer overflow, exploited in the wild, affects the switch web interface's request-processing path, where inadequate validation of incoming request data can allow memory corruption. An unauthenticated attacker on an adjacent network can exploit the flaw to execute operating-system commands.
These vulnerabilities collectively present a high risk of unauthenticated remote compromise for exposed switch deployments. The greatest risk is to devices reachable from untrusted or adjacent networks, especially where administrative interfaces are not isolated. Organizations should prioritize urgent response for affected deployments.
The following reports contain further technical details:
[/emaillocker]